Vulnerability fixes in util-linux-2.42.3

util-linux versions through 2.41.5 and through 2.42.2 fail to check the exit status of mount helpers before running post-mount hooks, so privileged post-mount actions still execute after a helper has failed. A local unprivileged user who can trigger affected mount paths (for example fstab-based mounts using the X-mount.idmap or X-mount.owner hooks) can induce a helper failure and have the hooks clone filesystems with inherited suid bits or modify target inode permissions. Successful exploitation yields local privilege escalation, letting the attacker perform privileged operations on pre-existing filesystems. Any Linux deployment running an affected util-linux version is potentially affected, though exploitability depends on local configurations that allow unprivileged users to invoke these mount helpers rather than on network exposure. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation in the next 30 days.

Do: Upgrade to util-linux 2.42.3, or to your distribution's patched package as soon as it is available. Until patched, audit fstab and automount configurations that permit unprivileged users to invoke mount helpers with X-mount.idmap or X-mount.owner and restrict or remove such entries. Also check local mounts for unexpectedly retained suid bits or changed ownership/permissions on target inodes, which would indicate attempted exploitation.

A time-of-check to time-of-use (TOCTOU) race (CWE-367) exists in util-linux's mount(8): restricted bind mounts take their source path from fstab but do not pin that source before performing the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor directory can race the SUID mount helper, causing it to bind a different host directory than the one authorized in fstab. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then applies the ownership or mode change to the redirected inode, letting the attacker have root alter arbitrary host directories, with potential for privilege escalation (CVSS 3.1: 7.8 high, local vector). Any Linux system running an affected util-linux that exposes user-mountable fstab bind entries is affected. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known; EPSS estimates only a 0.1% probability of exploitation within 30 days.

Do: Upgrade to util-linux 2.42.3, which contains the fix. Until patched, audit /etc/fstab for user-mountable bind mount entries — especially any using X-mount.owner, X-mount.group, or X-mount.mode — and ensure their source paths and all ancestor directories are not writable by untrusted local users, or remove the X-mount.* options from those entries.