CVE-2015-5224

Blkid in util-linux before version 2.26rc-1 allows local users to execute arbitrary code.

CVE-2016-2779 vulnerability in runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.

A flaw in util-linux: Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.

A heap use-after-free vulnerability was found in the libblkid library of util-linux. During nested partition probing, a pointer to a parent partition entry becomes stale after array reallocation, allowing an attacker to read freed memory.

In util-linux prior to version 2.41.4, a TOCTOU vulnerability has been identified in the SUID binary /usr/bin/mount. When setting up loop devices, mount validates the source file path with user privileges but later re-canonicalizes and opens it with root privileges without verifying that the path has not been replaced. A local unprivileged user can replace the source file with a symlink pointing to any root-owned file or device.

A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based PAM access control rules that rely on fully qualified domain names.

A flaw was found in util-linux that allows a heap buffer overread when processing 256-byte usernames in the `setpwnam()` function. This affects SUID login-utils utilities that write to the password database.