REDHAT-BUG-2531352: Medium severity BusyBox BusyBox vulnerability
A vulnerability exists in the BusyBox mount applet's non-root option filter in util-linux/mount.c. The filter uses cmdoptflags & ~MSSILENT to test for dangerous options, but clearing-mask options (suid, dev, exec) AND bits off rather than OR bits on, evaluating to zero and passing the check unconditionally. This allows a non-root user to strip nosuid, nodev, and noexec restrictions from fstab-defined user mounts.
The finding was reproduced only after artificially setting the setuid bit on BusyBox. Only the filter bypass was demonstrated, not actual privilege escalation.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
The finding was reproduced only when the BusyBox binary had its setuid bit artificially enabled. Environments where BusyBox is not setuid are not shown by the provided data to be affected in the demonstrated way.
What does an attacker need to exploit the filter bypass?
An attacker needs to be a non-root user able to invoke the BusyBox mount applet in a configuration using fstab-defined user mounts. They would use clearing-mask mount options such as suid, dev, or exec to remove nosuid, nodev, or noexec restrictions.
Was privilege escalation demonstrated?
No. The demonstrated impact was limited to bypassing the non-root option filter and stripping mount restrictions; actual privilege escalation was not demonstrated.