In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.

An update of the util package has been released.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4512-1 advisory.

  - In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding     shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a     different user, as demonstrated by logging in as root and entering umount followed by a tab character for     autocompletion. (CVE-2018-7738)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3268-1 advisory.

  - In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding     shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a     different user, as demonstrated by logging in as root and entering umount followed by a tab character for     autocompletion. (CVE-2018-7738)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of util-linux installed on the remote host is prior to 2.30.2-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1878 advisory.

    A command injection flaw was found in the way util-linux implements umount autocompletion in Bash. An     attacker with the ability to mount a filesystem with custom mount points may execute arbitrary commands on     behalf of the user who triggers the umount autocompletion. (CVE-2018-7738)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4512-1 advisory.

    It was discovered that the umount bash completion script shipped in util-linux incorrectly handled certain     mountpoints. If a local attacker were able to create arbitrary mountpoints, another user could be tricked     into executing arbitrary code when attempting to run the umount command with bash completion.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for util-linux fixes the following security issue :

  - CVE-2018-7738: Fix local vulnerability using embedded     shell commands in a mountpoint name (bsc#1084300)

This update was imported from the SUSE:SLE-15:Update update project.

This update for util-linux fixes the following issues :

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for util-linux fixes the following security issue :

  - CVE-2018-7738: Fix local vulnerability using embedded     shell commands in a mountpoint name (bsc#1084300)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for util-linux fixes the following issues :

This non-security issue was fixed :

  - CVE-2018-7738: bash-completion/umount allowed local     users to gain privileges by embedding shell commands in     a mountpoint name, which was mishandled during a umount     command by a different user (bsc#1084300).

These non-security issues were fixed :

  - Fixed crash loop in lscpu (bsc#1072947).

  - Fixed possible segfault of umount -a

  - Fixed mount -a on NFS bind mounts (bsc#1080740).

  - Fixed lsblk on NVMe (bsc#1078662).

This update was imported from the SUSE:SLE-12-SP3:Update update project.

Security fix for CVE-2018-7738

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bjorn Bosselmann discovered that the umount bash completion from util-linux does not properly handle embedded shell commands in a mountpoint name. An attacker with rights to mount filesystems can take advantage of this flaw for privilege escalation if a user (in particular root) is tricked into using the umount completion while a specially crafted mount is present.

The remote host is affected by the vulnerability described in GLSA-201803-02 (util-linux: User-assisted execution of arbitrary code)

    It was discovered that the umount bash-completion as provided by       util-linux does not escap mount point paths.
  Impact :

    An attacker controlling a volume label could entice a user with       privileges to mount/umount filesystems to use umount command with auto       completion, possibly resulting in execution of arbitrary code with root       privileges.
  Workaround :

    Disable Bash-completion or remove       &ldquo;/usr/share/bash-completion/completions/umount&rdquo;.

ID	Name	Product	Family	Severity
203050	Photon OS 2.0: Util PHSA-2018-2.0-0037	Nessus	PhotonOS Local Security Checks	high
186161	SUSE SLES15 Security Update : util-linux (SUSE-SU-2023:4512-1)	Nessus	SuSE Local Security Checks	high
179682	SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2023:3268-1)	Nessus	SuSE Local Security Checks	high
168443	Amazon Linux 2 : util-linux (ALAS-2022-1878)	Nessus	Amazon Linux Local Security Checks	critical
140648	Ubuntu 18.04 LTS : util-linux vulnerability (USN-4512-1)	Nessus	Ubuntu Local Security Checks	critical
123244	openSUSE Security Update : util-linux (openSUSE-2019-565)	Nessus	SuSE Local Security Checks	high
122228	SUSE SLES12 Security Update : util-linux (SUSE-SU-2019:0390-1)	Nessus	SuSE Local Security Checks	high
120059	SUSE SLED15 / SLES15 Security Update : util-linux (SUSE-SU-2018:2066-1)	Nessus	SuSE Local Security Checks	high
119284	SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2018:3926-1)	Nessus	SuSE Local Security Checks	high
111573	openSUSE Security Update : util-linux (openSUSE-2018-811)	Nessus	SuSE Local Security Checks	high
111567	openSUSE Security Update : util-linux (openSUSE-2018-805)	Nessus	SuSE Local Security Checks	high
111372	SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2018:2071-1)	Nessus	SuSE Local Security Checks	high
108308	Fedora 27 : util-linux (2018-668664ba84)	Nessus	Fedora Local Security Checks	high
107279	Debian DSA-4134-1 : util-linux - security update	Nessus	Debian Local Security Checks	high
107200	GLSA-201803-02 : util-linux: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2018-7738

critical

Tenable Plugins

high

high

high

critical

critical

high

high

high

high

high

high

high

high

high

high