Privilege escalation in Util-linux - CVE-2018-7738

Vulnerability identifier: #VU10957

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7738

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to insufficient validation of shell commands that are used in the name of a mountpoint. A local attacker can embed crafted shell commands in the name of a mountpoint. If another user on the system executes the umount command along with a tab character for autocomplete, the attacker can gain elevated privileges.

Util-linux
Gentoo Linux
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE CaaS Platform
SUSE Linux Enterprise Workstation Extension 12
Opensuse
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
openSUSE Leap
Ubuntu
Fedora
util-linux
util-linux (Ubuntu package)
python-libmount-debuginfo
python-libmount-debugsource
libblkid1-32bit
libblkid1
python-libmount
libblkid1-debuginfo
util-linux-systemd
libfdisk1
util-linux-lang
libmount1-debuginfo-32bit
libuuid1-32bit
util-linux-debuginfo
libblkid1-debuginfo-32bit
libmount1-32bit
libuuid1-debuginfo-32bit
libsmartcols-devel
uuidd-debuginfo
libblkid-devel
util-linux-debugsource
libuuid-devel
libmount-devel
libuuid1
libuuid1-debuginfo
libmount1
util-linux-systemd-debugsource
util-linux-systemd-debuginfo
libmount1-debuginfo
libsmartcols1
libfdisk1-debuginfo
libsmartcols1-debuginfo
uuidd
libmount1-32bit-debuginfo
libuuid1-32bit-debuginfo
libblkid1-32bit-debuginfo
libuuid-devel-static
libfdisk-devel
libblkid-devel-static
EMC ViPR SRM
Dell EMC Storage Monitoring and Reporting (SMR)
RecoverPoint for VMs
Index Engines CyberSense
Juniper Cloud Native Router
Junos cRPD

Update to version 2.32-rc1.

util-linux - update to 2.30.2-2.fc27
util-linux (Ubuntu package) - update to 2.31.1-0.4ubuntu3.7
python-libmount-debuginfo - addressed in versions 2.31.1-150000.9.24.1, 2.33.2-4.33.1
python-libmount-debugsource - addressed in versions 2.31.1-150000.9.24.1, 2.33.2-4.33.1
libblkid1-32bit - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libblkid1 - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
python-libmount - update to 2.33.2-4.33.1
libblkid1-debuginfo - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
util-linux-systemd - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libfdisk1 - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
util-linux - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
util-linux-lang - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libmount1-debuginfo-32bit - update to 2.33.2-4.33.1
libuuid1-32bit - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
util-linux-debuginfo - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libblkid1-debuginfo-32bit - update to 2.33.2-4.33.1
libmount1-32bit - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libuuid1-debuginfo-32bit - update to 2.33.2-4.33.1
libsmartcols-devel - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
uuidd-debuginfo - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libblkid-devel - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
util-linux-debugsource - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libuuid-devel - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libmount-devel - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libuuid1 - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libuuid1-debuginfo - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libmount1 - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
util-linux-systemd-debugsource - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
util-linux-systemd-debuginfo - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libmount1-debuginfo - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libsmartcols1 - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libfdisk1-debuginfo - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libsmartcols1-debuginfo - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
uuidd - addressed in versions 2.33.2-4.33.1, 2.33.2-150100.4.40.1
libmount1-32bit-debuginfo - update to 2.33.2-150100.4.40.1
libuuid1-32bit-debuginfo - update to 2.33.2-150100.4.40.1
libblkid1-32bit-debuginfo - update to 2.33.2-150100.4.40.1
libuuid-devel-static - update to 2.33.2-150100.4.40.1
libfdisk-devel - update to 2.33.2-150100.4.40.1
libblkid-devel-static - update to 2.33.2-150100.4.40.1
EMC ViPR SRM - update to 4.10.0.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.0
RecoverPoint for VMs - update to 6.0.SP1.P1
Index Engines CyberSense - update to 8.4
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1

• https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.32/v2.32-rc1-ChangeLog

• Privilege escalation in util-linux
• Debian update for util-linux
• Gentoo update for util-linux
• OpenSUSE Linux update for util-linux
• OpenSUSE Linux update for util-linux
• OpenSUSE Linux update for util-linux
• SUSE update for util-linux
• SUSE update for util-linux
• SUSE update for util-linux
• Multiple vulnerabilities in Index Engines CyberSense
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Ubuntu update for util-linux
• Fedora 27 update for util-linux
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)