CVE-2011-3145 mount.ecrpytfs_private sets group owner of /etc/mtab to user's primary group
CriticalCVSS 9.8
EPSS 0.98%
- Published
- Updated
- Exploit status
- No public exploit known
Description
When mount.ecrpytfs_private before version 87-0ubuntu1.2 calls setreuid() it doesn't also set the effective group id. So when it creates the new version, mtab.tmp, it's created with the group id of the user running mount.ecryptfs_private.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ecryptfs-utils(Debian:12) | < 92-1 | 92-1 |
| debian/ecryptfs-utils(Debian:13) | < 92-1 | 92-1 |
| debian/ecryptfs-utils(Debian:14) | < 92-1 | 92-1 |
| mount.ecrpytfs private project mount.ecrpytfs private | All versions | No fix listed |
References
- Debian Security Tracker CVE-2011-3145 vendor-advisory
- bazaar.launchpad.net patch third-party-advisory