Alerts This Week
Warning Icon 1 646
Alerts This Week
Warning Icon 1 646

Gentoo: GLSA-201803-02 High: util-linux Arbitrary Code Execution

gentoo
Calendar Grey March 7, 2018
Dist Gentoo Esm H88
A critical flaw in util-linux might enable unauthorized code execution via user-initiated steps.
A vulnerability was discovered in util-linux, which could potentially lead to the execution of arbitrary code.

Summary

It was discovered that the umount bash-completion as provided by util-linux does not escap mount point paths.

Topics%20covered

Topics Covered

security advisory util-linux high arbitrary code Gentoo Linux

Resolution

All util-linux users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/util-linux-2.30.2-r1"

References

[ 1 ] CVE-2018-7738 https://nvd.nist.gov/vuln/detail/CVE-2018-7738

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201803-02
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: High
Title: util-linux: User-assisted execution of arbitrary code
Date: March 07, 2018
Bugs: #649812
ID: 201803-02

Topics%20covered

Topics Covered

security advisory util-linux high arbitrary code Gentoo Linux

Synopsis

A vulnerability was discovered in util-linux, which could potentially lead to the execution of arbitrary code.

Background

util-linux is a suite of Linux programs including mount and umount, programs used to mount and unmount filesystems.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/util-linux < 2.30.2-r1 >= 2.30.2-r1

Impact

===== An attacker controlling a volume label could entice a user with privileges to mount/umount filesystems to use umount command with auto completion, possibly resulting in execution of arbitrary code with root privileges.

Workaround

Disable Bash-completion or remove "/usr/share/bash-completion/completions/umount".

Related News

Your message here