CVE-2021-3996

    Dashboard / Vulnerabilities / CVE-2021-3996

    CVE-2021-3996

    Published: 23 Aug 2022Last Modified: 9 Jul 2026

    Summary:

    Details: A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.

    References: http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html, http://seclists.org/fulldisclosure/2022/Dec/4, http://www.openwall.com/lists/oss-security/2022/11/30/2, https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.3-ReleaseNotes, https://security.gentoo.org/glsa/202401-08, https://security.netapp.com/advisory/ntap-20221209-0002/, https://access.redhat.com/security/cve/CVE-2021-3996, https://bugzilla.redhat.com/show_bug.cgi?id=2024628, https://github.com/util-linux/util-linux/commit/166e87368ae88bf31112a30e078cceae637f4cdb, https://www.openwall.com/lists/oss-security/2022/01/24/2

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- d4319b91c9d7d69e7b954fc66819214f81501312
    Fixed -331a1e6e10f7943a12112c7161a8c995c1c5b9b9

    Affected versions

    v2.37.2
    v2.37.1
    v2.37

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-3996 | CVE-DB