Skip to Content.
Sympa Menu

sm-security - [SM-Security] util-linux: umount vulnerability

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas HOUSSIN <thomas.houssin AT gmail.com>
  • To: sm-security <sm-security AT lists.ibiblio.org>
  • Subject: [SM-Security] util-linux: umount vulnerability
  • Date: Wed, 21 Sep 2005 17:45:59 +0200

Synopsis
========
When unmounting a filesystem with the '-r' option, the file system is
remounted with the MS_RDONLY ("ro") flag alone, thus clearing all its
other flags, including nosuid and nodev.

Background
==========
Util-linux is a suite of essential utilities for any Linux system. Its
primary audience is system integrators and DIY Linux hackers.
Util-linux is attempting to be portable, but the only platform it has
been tested much on is Linux i386.

Description
===========
CAN-2005-2876:
umount in util-linux 2.8 to 2.12q, 2.13-pre1, and 2.13-pre2 allows
local users with unmount permissions to gain privileges via the -r
(remount) option, which causes the file system to be remounted with
just the read-only flag, which effectively clears the nosuid, nodev,
and other flags.

Impact
======
An unprivileged user can use this vulnerability to all flags except
'ro', allowing applications to be executed suid, or have device nodes
interpreted. If the user can freely write on the filesystem, privilege
escalation may occur (for example by creating und running a custom
program with suid permissions).

Workaround
==========
Removing the setuid bit from umount is a first workaround. Another is
to edit /etc/fstab to restrict user from mounting and unmounting
filesystems.

Affected packages
=================
util-linux in all grimoires is affected. This is now fixed in devel,
test, stable-rc/0.2 and stable/0.1 grimoires.

Resolution
==========
All util-linux users should upgrade to the latest available version:
# scribe update
# cast -c util-linux

References
==========
[ 1 ] CAN-2005-2876
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2005-2876
[ 2 ] unintentional grant of privileges by umount
http://www.securityfocus.com/archive/1/410333

--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36



  • [SM-Security] util-linux: umount vulnerability, Thomas HOUSSIN, 09/21/2005

Archive powered by MHonArc 2.6.24.

Top of Page