Critical Vulnerability in FUSE Package: SELinux Restriction Bypass
Summary
ALPINE-CVE-2018-10906: In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. Affects fuse versions < 2.9.8-r0. Fixed in 2.9.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FUSE (Filesystem in Userspace) is a software interface that allows users to create their own file systems without editing kernel code. It provides a way to mount file systems implemented in user space, enabling various applications to manage file systems more flexibly. However, certain versions of FUSE are vulnerable to a security flaw that can be exploited when SELinux is active, potentially allowing unauthorized access to mounted file systems.
Vulnerability Detail
In FUSE versions prior to 2.9.8 and 3.x before 3.2.5, a vulnerability exists in the 'fusermount' utility that allows non-root users to mount a FUSE file system with the 'allow_other' option, bypassing the 'user_allow_other' setting in the FUSE configuration. This flaw can lead to unauthorized access to files on the mounted file system, potentially causing Denial of Service or other unspecified effects. The CVSS score for this vulnerability is 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.9.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade fuseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the use of the 'allow_other' option in your FUSE configurations until the package is updated. This can be done by ensuring that 'user_allow_other' is not set in the FUSE configuration file, typically located at '/etc/fuse.conf'.
Conclusion
The vulnerability in the FUSE package poses a significant risk to systems using affected versions, particularly when SELinux is active. Immediate action should be taken to update to the patched versions to mitigate potential security threats. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for fuse →
FAQ
The vulnerability allows non-root users to mount FUSE file systems with elevated permissions, potentially exposing sensitive data to unauthorized users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, ensure that the 'allow_other' option is not enabled in your FUSE configurations as a temporary measure.
FUSE versions prior to 2.9.8 and 3.x before 3.2.5 are affected by this vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities, helping developers maintain secure applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for fuse.
