[Forgot Password]
Login  Register Subscribe

30479

 
 

423868

 
 

250770

 
 

909

 
 

196157

 
 

282

Paid content will be excluded from the download.


Download | Alert*
OVAL

ALAS2023-2023-024 --- util-linux

ID: oval:org.secpod.oval:def:19500021Date: (C)2023-06-12   (M)2024-01-08
Class: PATCHFamily: unix




A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems. A flaw was found in the Linux kernel's util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an INPUTRC environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation

Platform:
Amazon Linux 2023
Product:
util-linux
python3-libmount
libuuid
libblkid
uuidd
libmount
libsmartcols
libfdisk
Reference:
ALAS2023-2023-024
CVE-2021-3995
CVE-2021-3996
CVE-2022-0563
CVE    3
CVE-2021-3995
CVE-2021-3996
CVE-2022-0563
CPE    2
cpe:/a:linux:util-linux
cpe:/a:uuidd:uuidd

© SecPod Technologies