FUSE through version 3.2.4 is vulnerable to a bypass of the 'userallowother' restriction that allows, when SELinux is active, non-root users to mount FUSE file systems with the 'allowother' mount option. Local users can exploit this with the 'fusermount' command, bypassing the system configuration. This results in a mounted file system accessible by all other users including root.

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNTMTAB environment variable that is used by mount's debugging feature.