CVE-2017-8849

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify...

7.8 HighPublic exploitFix available

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.95%Down 3.3 points since Apr 14, 2021

What each source reports

NVD Score used 7.8

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.

Record: CVE-2017-8849
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.

Record: CVE-2017-8849
Updated: 2026-11-02

EUVDEUVD-2017-17791 No score

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.

Record: EUVD-2017-17791
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r2c6-g9q3-2m7j 7.8

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify...

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.

Record: GHSA-r2c6-g9q3-2m7j
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-20
Updated: 2026-11-02

OSV 7.8

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.

Record: CVE-2017-8849
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-8849 7.8

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.

Record: DEBIAN-CVE-2017-8849
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-8849 7.8

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.

Record: UBUNTU-CVE-2017-8849
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2017-0171 No score

Updated smb4k packages fix security vulnerability

Smb4k contains a logic flaw in which mount helper binary does not properly verify the mount command it is being asked to run. This allows calling any other binary as root since the mount helper is typically installed as suid (CVE-2017-8849).

Record: MGASA-2017-0171
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10370-1 No score

smb4k-4.0.5-1.2 on GA media

These are all security issues fixed in the smb4k-4.0.5-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10370-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`smb4k` Debian:13	before 1.2.1-2	1.2.1-2
`smb4k` Debian:14	before 1.2.1-2	1.2.1-2
`smb4k` Debian:7	before 1.2.1-2~deb7u1, plus listed versions 1.0.1-11.0.6-11.0.7-11.0.8-11.0.9-11.1.2-11.2.1-1	1.2.1-2~deb7u1
`smb4k` Debian:8	before 1.2.1-2~deb8u1, plus listed versions 1.1.2-11.2.1-11.2.1-2~deb7u1	1.2.1-2~deb8u1
`smb4k` Mageia:5	before 1.2.3-1.mga5	1.2.3-1.mga5
`smb4k` Ubuntu:16.04:LTS	All versions, plus listed versions 1.1.2-1	None known
`smb4k` openSUSE:Tumbleweed From an advisory covering 2 CVEs	before 4.0.5-1.2	4.0.5-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	KDE 4/5 - 'KAuth' Local Privilege Escalation	2017-05-18

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-8849 is a high vulnerability (CVSS 7.8) in Smb4k Project Smb4k, published May 17, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.95%, the 80th percentile. Fixed in smb4k 1.2.1-2.

References

Show 13 moreShow less