util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.
Weakness
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Util-linux | Kernel | * | 2.41.4 (excluding) |
| Red Hat Hardened Images | RedHat | util-linux-main-2.42-7.1.hum1 | * |
| Util-linux | Ubuntu | devel | * |
| Util-linux | Ubuntu | esm-infra-legacy/trusty | * |
| Util-linux | Ubuntu | esm-infra-legacy/xenial | * |
| Util-linux | Ubuntu | esm-infra/bionic | * |
| Util-linux | Ubuntu | esm-infra/focal | * |
| Util-linux | Ubuntu | esm-infra/xenial | * |
| Util-linux | Ubuntu | jammy | * |
| Util-linux | Ubuntu | noble | * |
| Util-linux | Ubuntu | questing | * |
| Util-linux | Ubuntu | resolute | * |
| Util-linux | Ubuntu | upstream | * |
Potential Mitigations
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/132.html
- https://cwe.mitre.org/data/definitions/17.html
- https://cwe.mitre.org/data/definitions/35.html
- https://cwe.mitre.org/data/definitions/76.html
References
- https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4
- https://github.com/util-linux/util-linux/releases/tag/v2.41.4
- https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g
- https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g