Logic Error in libmount Library of util-linux
Summary
CVE-2021-3995: A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. Affects util-linux across 3 version ranges.
< 2.37.3-r0
< 57202f5713afa2af20ffbb6ab5331481d0396f8d
>= d4319b91c9d7d69e7b954fc66819214f81501312, < 331a1e6e10f7943a12112c7161a8c995c1c5b9b9
Fixed in 2.37.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The util-linux package is a collection of essential utilities for Linux systems. It provides various tools for managing file systems, mounting and unmounting devices, and performing other system-related tasks. The libmount library within util-linux is responsible for handling mount and unmount operations. It is commonly used by applications and system components to manage file systems and mount points.
Vulnerability Detail
A logic error has been discovered in the libmount library of util-linux. The vulnerability allows an unprivileged local attacker to unmount FUSE (Filesystem in Userspace) filesystems that belong to certain other users. This can be exploited when the attacker's User ID (UID) is a prefix of the UID of the target user. By leveraging this flaw, an attacker can cause a denial of service to applications that rely on the affected filesystems. The vulnerability has a CVSSv3 score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.37.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade util-linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at the moment. It is advised to apply the recommended fix by updating the util-linux package to the latest version.
Conclusion
In conclusion, a logic error in the libmount library of util-linux allows unprivileged local attackers to unmount FUSE filesystems belonging to certain other users. This can result in a denial of service to applications using the affected filesystems. It is recommended to update the util-linux package to version 2.37.3-r0 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for util-linux →
FAQ
Util-linux is a collection of essential utilities for Linux systems, providing tools for managing file systems, mounting and unmounting devices, and performing other system-related tasks.
The libmount library is part of the util-linux package and is responsible for handling mount and unmount operations. It is commonly used by applications and system components to manage file systems and mount points.
A FUSE (Filesystem in Userspace) filesystem allows non-privileged users to create and mount file systems without requiring root access. It enables users to implement custom file systems using user-level code.
An unprivileged local attacker can exploit this vulnerability by unmounting FUSE filesystems that belong to certain other users. The attacker's UID must be a prefix of the target user's UID in its string form.
The vulnerability allows an attacker to cause a denial of service to applications that rely on the affected FUSE filesystems. This can disrupt the normal operation of these applications and potentially lead to data loss or system instability.
Related vulnerabilities
Recent vulnerabilities recorded for util-linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
