Log in Start free

Vulnerability · Published Aug 23, 2022 · Assigned by redhat

CVE-2021-3995

Medium 5.5

In plain English

A medium-severity security flaw in util-linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.6%top 49.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20util-linux2.37.3-r0ALPINE-CVE-2021-3995
Alpine:v3.21util-linux2.37.3-r0ALPINE-CVE-2021-3995
Alpine:v3.22util-linux2.37.3-r0ALPINE-CVE-2021-3995
Alpine:v3.23util-linux2.37.3-r0ALPINE-CVE-2021-3995
Alpine:v3.24util-linux2.37.3-r0ALPINE-CVE-2021-3995
Debian:12util-linux2.37.3-1DEBIAN-CVE-2021-3995
Debian:13util-linux2.37.3-1DEBIAN-CVE-2021-3995
Debian:14util-linux2.37.3-1DEBIAN-CVE-2021-3995
Ubuntu:22.04:LTSutil-linux2.37.2-4ubuntu2UBUNTU-CVE-2021-3995

Affected products (as reported)

VendorProductVersions
n/a util-linux Fixed in util-linux v2.37.3

Weakness: CWE-552

References