ALT-PU-2019-4176-1
Closed vulnerabilities
Published: 2019-02-05
Modified: 2025-03-19
Modified: 2025-03-19
BDU:2019-00421
Уязвимость модуля fusermount драйвера файловых систем для UNIX-подобных операционных систем FUSE, позволяющая нарушителю вызвать отказ в обслуживании или другое неопределенное поведение
Severity: HIGH (7.8)Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: MEDIUM (4.6)Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
References:
Published: 2018-07-24
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2018-10906
In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.
Severity: MEDIUM (4.6)Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Severity: HIGH (7.8)Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
- https://access.redhat.com/errata/RHSA-2018:3324
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10906
- https://lists.debian.org/debian-lts-announce/2018/08/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5XYA6PXT5PPWVK7CM7K4YRCYWA37DODB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A253TZWZK6R7PT2S5JIEAQJR2TYKX7V2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BREAIWIK64DRJWHIGR47L2D5YICY4HQ3/
- https://www.debian.org/security/2018/dsa-4257
- https://www.exploit-db.com/exploits/45106/
- https://access.redhat.com/errata/RHSA-2018:3324
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10906
- https://lists.debian.org/debian-lts-announce/2018/08/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5XYA6PXT5PPWVK7CM7K4YRCYWA37DODB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A253TZWZK6R7PT2S5JIEAQJR2TYKX7V2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BREAIWIK64DRJWHIGR47L2D5YICY4HQ3/
- https://www.debian.org/security/2018/dsa-4257
- https://www.exploit-db.com/exploits/45106/
