Log in Start free

Vulnerability · Published Aug 23, 2022 · Assigned by redhat

CVE-2021-3996

Medium 5.5

In plain English

A medium-severity security flaw in util-linux. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.6%top 49.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20util-linux2.37.3-r0ALPINE-CVE-2021-3996
Alpine:v3.21util-linux2.37.3-r0ALPINE-CVE-2021-3996
Alpine:v3.22util-linux2.37.3-r0ALPINE-CVE-2021-3996
Alpine:v3.23util-linux2.37.3-r0ALPINE-CVE-2021-3996
Alpine:v3.24util-linux2.37.3-r0ALPINE-CVE-2021-3996
Debian:12util-linux2.37.3-1DEBIAN-CVE-2021-3996
Debian:13util-linux2.37.3-1DEBIAN-CVE-2021-3996
Debian:14util-linux2.37.3-1DEBIAN-CVE-2021-3996
Ubuntu:22.04:LTSutil-linux2.37.2-4ubuntu2UBUNTU-CVE-2021-3996

Affected products (as reported)

VendorProductVersions
n/a util-linux Fixed in util-linux v2.37.3

Weakness: CWE-552 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References