CVE-2018-7738 In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash)....
HighCVSS 7.8
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/bash-completion(Debian:12) | All versions | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.11-6 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.11-7 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.11-8 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.12.0-1 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.13.0-1 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.14.0-1 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.14.0-2 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.16.0-1 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.16.0-2 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.16.0-3 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.16.0-4 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.16.0-5 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.16.0-6 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.16.0-7 | No fix listed |
| debian/bash-completion(Debian:12) | = 1:2.16.0-8 | No fix listed |
| debian/bash-completion(Debian:13) | All versions | No fix listed |
| debian/bash-completion(Debian:13) | = 1:2.16.0-7 | No fix listed |
| debian/bash-completion(Debian:13) | = 1:2.16.0-8 | No fix listed |
| debian/bash-completion(Debian:14) | All versions | No fix listed |
| debian/bash-completion(Debian:14) | = 1:2.16.0-7 | No fix listed |
| debian/bash-completion(Debian:14) | = 1:2.16.0-8 | No fix listed |
| debian/util-linux(Debian:12) | < 2.31.1-0.5 | 2.31.1-0.5 |
| debian/util-linux(Debian:13) | < 2.31.1-0.5 | 2.31.1-0.5 |
| debian/util-linux(Debian:14) | < 2.31.1-0.5 | 2.31.1-0.5 |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| kernel util-linux | <= 2.31 | No fix listed |
References
- Debian Security Tracker CVE-2018-7738 vendor-advisory
- 103367 third-party-advisory vdb-entry
- bugs.debian.org issue-tracking patch third-party-advisory
- github.com patch third-party-advisory
- github.com issue-tracking third-party-advisory
- USN-4512-1 vendor-advisory
- DSA-4134 third-party-advisory vendor-advisory
- security.netapp.com