Skip to content
Commit 96a4d9ad authored by Tudor Florea's avatar Tudor Florea Committed by Martin Jansa
Browse files

fuse: fix for CVE-2015-3202 Privilege Escalation

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before
invoking (1) mount or (2) umount as root, which allows local users to write
to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is
used by mount's debugging feature.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3202
http://www.openwall.com/lists/oss-security/2015/05/21/9



Signed-off-by: default avatarTudor Florea <tudor.florea@enea.com>
Signed-off-by: default avatarMartin Jansa <Martin.Jansa@gmail.com>
parent 81d8056d
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment