OESA-2022-1536

Dashboard / Vulnerabilities / OESA-2022-1536

OESA-2022-1536

Summary: util-linux security update

Details: The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fix(es): A logical error was found in util-linux's libmount library in a function that allows unprivileged users to unmount FUSE filesystems. Incorrect uid checking allows unprivileged users to unmount FUSE filesystems with similar uid users, an attacker could exploit this vulnerability to cause a denial of service to applications using the affected filesystem.(CVE-2021-3995) that allows unprivileged users to unmount FUSE filesystems. Issues related to parsing the /proc/self/mountinfo file allow unprivileged users to unmount other users' filesystems that are themselves world-writable (such as /tmp) or mounted in a world-writable directory. An attacker could exploit this vulnerability to cause a denial of service to applications that use the affected file system.(CVE-2021-3996)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1536, https://nvd.nist.gov/vuln/detail/CVE-2021-3995, https://nvd.nist.gov/vuln/detail/CVE-2021-3996