CVE-2018-7738: High severity kernel util-linux vulnerability
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/util-linuxto a version that resolves this vulnerability.Fixed in 2.36.1-8+deb11u2Fixed in 2.38.1-5+deb12u3Fixed in 2.38.1-5+deb12u1Fixed in 2.41-5Fixed in 2.42.2-2 - Upgrade
Upgrade
util-linuxto a version that resolves this vulnerability.Fixed in 2.32-rc1 - Compensating control
Until the util-linux update to 2.32-rc1 is applied, restrict access to run the affected umount command (e.g., limit local user permissions or use an appropriate policy so unprivileged users cannot trigger umount/umount autocompletion-related behavior).
Event History
Frequently Asked Questions
What is CVE-2018-7738?
CVE-2018-7738 is a vulnerability in util-linux before 2.32-rc1 that allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command.
How can an attacker exploit CVE-2018-7738?
An attacker can exploit CVE-2018-7738 by creating a malicious mountpoint name with embedded shell commands, and then triggering a umount command as a different user.
What is the severity of CVE-2018-7738?
CVE-2018-7738 has a severity rating of 7.8 (high).
Which versions of util-linux are affected by CVE-2018-7738?
Versions before 2.32-rc1 of util-linux are affected by CVE-2018-7738.
Is there a fix available for CVE-2018-7738?
Yes, the fix for CVE-2018-7738 is included in version 2.32-rc1 of util-linux.