A vulnerability has been reported in util-linux, which potentially can be exploited by malicious, local users to perform certain actions with escalated privileges.
The vulnerability is caused due to the mount and umount programs incorrectly checking the return values of the "setuid()" and "setgid()" functions when dropping privileges. This can potentially be exploited to perform certain actions with escalated privileges via e.g. the mount.nfs utility.
The vulnerability is reported in version 2.12r. Other versions may also be affected.
Fixed in the util-linux-ng repository.
You already applied the patch in -r8 a few days ago, but I couldn't find an appropriate security bug for this issue.
Do you have plans to stabilise util-linux-2.12r-r8? Our latest stable version is vulnerable.
i dont have any plans for anything
whatever security team wants to push is up to them, 2.12r-r8 is fine
Arches pleases test and mark stable sys-apps/util-linux-2.12r-r8
target "alpha amd64 arm hppa ia64 m68k mips ppc ppc64 s390 sh sparc x86"
Stable for HPPA
Stable for SPARC.
stable on ppc64
ppc stable, ready for glsa
(In reply to comment #10)
> ppc stable, ready for glsa