Bug 359895 – sys-fs/fuse: Unprivileged user can unmount arbitrary locations via symlink attack (CVE-2010-3879,CVE-2011-{0541,0542,0543})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Paweł Hajdan, Jr. (RETIRED) 2011-03-22 09:18:41 UTC]

https://bugzilla.redhat.com/show_bug.cgi?id=651183 seems to indicate there are still problems with fuse-2.8.5, see https://bugzilla.redhat.com/show_bug.cgi?id=651183#c40

[Comment 1 GLSAMaker/CVETool Bot 2011-06-24 19:55:52 UTC]

CVE-2010-3879 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3879):
  FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries
  with arbitrary pathnames, and consequently unmount any filesystem, via a
  symlink attack on the parent directory of the mountpoint of a FUSE
  filesystem, a different vulnerability than CVE-2010-0789.

[Comment 2 GLSAMaker/CVETool Bot 2011-10-08 13:43:04 UTC]

CVE-2011-0543 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0543):
  Certain legacy functionality in fusermount in fuse 2.8.5 and earlier, when
  util-linux does not support the --no-canonicalize option, allows local users
  to bypass intended access restrictions and unmount arbitrary directories via
  a symlink attack.

CVE-2011-0542 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0542):
  fusermount in fuse 2.8.5 and earlier does not perform a chdir to / before
  performing a mount or umount, which allows local users to unmount arbitrary
  directories via unspecified vectors.

CVE-2011-0541 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0541):
  fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be
  updated, which allows local users to unmount arbitrary directories via a
  symlink attack.

[Comment 3 Chris Reffett (RETIRED) 2013-09-03 18:17:33 UTC]

No affected versions in tree. Recent enough for a GLSA vote, I guess. GLSA vote: no.

[Comment 4 Tobias Heinlein (RETIRED) 2013-09-03 18:26:16 UTC]

NO too, closing.