Описание
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.
Отчет
Affected versions: util-linux v2.39 through v2.42.2. X-mount.owner/group/mode was introduced in v2.39; earlier releases are not affected. Fixed in v2.41.6 and v2.42.3.
Меры по смягчению последствий
Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not allow unprivileged /etc/fstab bind or rbind entries that also specify X-mount.owner, X-mount.group, or X-mount.mode, especially when the bind source is below a user-writable ancestor.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | util-linux | Affected | ||
| Red Hat Enterprise Linux 7 | util-linux | Not affected | ||
| Red Hat Enterprise Linux 8 | util-linux | Not affected | ||
| Red Hat Enterprise Linux 9 | rhel8/flatpak-runtime | Not affected | ||
| Red Hat Enterprise Linux 9 | rhel8/flatpak-sdk | Not affected | ||
| Red Hat Enterprise Linux 9 | util-linux | Not affected | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Not affected | ||
| Red Hat Hardened Images | util-linux-main-2.42.2-3.4.hum1 | Fixed | RHSA-2026:63162 | 03.09.2026 |
Показывать по
Дополнительная информация
Статус:
7.8 High
CVSS3
Связанные уязвимости
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.
Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection
A flaw was found in util-linux. Restricted bind mounts take the source ...
7.8 High
CVSS3