A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.

An update of the util package has been released.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the util-linux-2.37.4-3.el9 build changelog.

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202401-08 (util-linux: Multiple Vulnerabilities)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker     were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file.
    NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments     (CVE-2021-37600)

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-024 advisory.

    A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

    A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

    A flaw was found in the Linux kernel's util-linux chfn and chsh utilities when compiled with Readline     support. The Readline library uses an INPUTRC environment variable to get a path to the library config     file. When the library cannot parse the specified file, it prints an error message containing data from     the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege     escalation. (CVE-2022-0563)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of util-linux installed on the remote host is prior to 2.37.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-218 advisory.

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-099 advisory.

    A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

    A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

    A flaw was found in the Linux kernel's util-linux chfn and chsh utilities when compiled with Readline     support. The Readline library uses an INPUTRC environment variable to get a path to the library config     file. When the library cannot parse the specified file, it prints an error message containing data from     the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege     escalation. (CVE-2022-0563)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-086 advisory.

    A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

    A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the util-linux package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an 'INPUTRC' environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

  - A logical error was found in util-linux's libmount library in a function that allows unprivileged users to     unmount FUSE filesystems. Incorrect uid checking allows unprivileged users to unmount FUSE filesystems     with similar uid users, an attacker could exploit this vulnerability to cause a denial of (CVE-2021-3995)

  - that allows unprivileged users to unmount FUSE filesystems. Issues related to parsing the     /proc/self/mountinfo file allow unprivileged users to unmount other users' filesystems that are themselves     world-writable (such as /tmp) or mounted in a world-writable directory. An attacker could exploit this     (CVE-2021-3996)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0727-1 advisory.

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0727-1 advisory.

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5279-1 advisory.

    It was discovered that util-linux incorrectly handled unmounting FUSE filesystems. A local attacker could     possibly use this issue to unmount FUSE filesystems belonging to other users.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5055 advisory.

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203463	Photon OS 4.0: Util PHSA-2022-4.0-0147	Nessus	PhotonOS Local Security Checks	medium
191356	CentOS 9 : util-linux-2.37.4-3.el9	Nessus	CentOS Local Security Checks	medium
187668	GLSA-202401-08 : util-linux: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
173184	Amazon Linux 2023 : libblkid, libblkid-devel, libfdisk (ALAS2023-2023-024)	Nessus	Amazon Linux Local Security Checks	medium
168590	Amazon Linux 2022 : util-linux (ALAS2022-2022-218)	Nessus	Amazon Linux Local Security Checks	medium
164772	Amazon Linux 2022 : libblkid, libblkid-devel, libfdisk (ALAS2022-2022-099)	Nessus	Amazon Linux Local Security Checks	medium
164755	Amazon Linux 2022 : libblkid, libblkid-devel, libfdisk (ALAS2022-2022-086)	Nessus	Amazon Linux Local Security Checks	medium
163219	EulerOS Virtualization 2.10.1 : util-linux (EulerOS-SA-2022-2069)	Nessus	Huawei Local Security Checks	medium
163197	EulerOS Virtualization 2.10.0 : util-linux (EulerOS-SA-2022-2041)	Nessus	Huawei Local Security Checks	medium
160673	EulerOS 2.0 SP10 : util-linux (EulerOS-SA-2022-1654)	Nessus	Huawei Local Security Checks	medium
160658	EulerOS 2.0 SP10 : util-linux (EulerOS-SA-2022-1668)	Nessus	Huawei Local Security Checks	medium
160591	EulerOS Virtualization 2.9.0 : util-linux (EulerOS-SA-2022-1640)	Nessus	Huawei Local Security Checks	medium
160587	EulerOS Virtualization 2.9.1 : util-linux (EulerOS-SA-2022-1616)	Nessus	Huawei Local Security Checks	medium
159780	EulerOS 2.0 SP9 : util-linux (EulerOS-SA-2022-1440)	Nessus	Huawei Local Security Checks	medium
159776	EulerOS 2.0 SP9 : util-linux (EulerOS-SA-2022-1461)	Nessus	Huawei Local Security Checks	medium
158640	openSUSE 15 Security Update : libeconf, shadow and util-linux (openSUSE-SU-2022:0727-1)	Nessus	SuSE Local Security Checks	medium
158608	SUSE SLED15 / SLES15 Security Update : libeconf, shadow and util-linux (SUSE-SU-2022:0727-1)	Nessus	SuSE Local Security Checks	medium
157843	Ubuntu 20.04 LTS : util-linux vulnerabilities (USN-5279-1)	Nessus	Ubuntu Local Security Checks	medium
157263	Debian DSA-5055-1 : util-linux - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2021-3996

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium