CVE-2018-7738

In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.

A command injection flaw was found in the way util-linux implements umount autocompletion in Bash. An attacker with the ability to mount a filesystem with custom mount points may execute arbitrary commands on behalf of the user who triggers the umount autocompletion (CVE-2018-7738).

This update for util-linux fixes the following security issue:

• CVE-2018-7738: Fix local vulnerability using embedded shell commands in a mountpoint name (bsc#1084300)

This update for util-linux fixes the following issues:

This non-security issue was fixed:

• CVE-2018-7738: bash-completion/umount allowed local users to gain privileges by embedding shell commands in a mountpoint name, which was mishandled during a umount command by a different user (bsc#1084300).

These non-security issues were fixed:

• Fixed crash loop in lscpu (bsc#1072947).
• Fixed possible segfault of umount -a
• Fixed mount -a on NFS bind mounts (bsc#1080740).
• Fixed lsblk on NVMe (bsc#1078662).

This update for util-linux fixes the following issues:

This non-security issue was fixed:

• CVE-2018-7738: bash-completion/umount allowed local users to gain privileges by embedding shell commands in a mountpoint name, which was mishandled during a umount command by a different user (bsc#1084300).

These non-security issues were fixed:

• Fixed crash loop in lscpu (bsc#1072947).
• Fixed possible segfault of umount -a
• Fixed mount -a on NFS bind mounts (bsc#1080740).
• Fixed lsblk on NVMe (bsc#1078662).

This update for util-linux fixes the following issues:

This non-security issue was fixed:

• CVE-2018-7738: bash-completion/umount allowed local users to gain privileges by embedding shell commands in a mountpoint name, which was mishandled during a umount command by a different user (bsc#1084300).

These non-security issues were fixed:

• Fixed crash loop in lscpu (bsc#1072947).
• Fixed possible segfault of umount -a
• Fixed mount -a on NFS bind mounts (bsc#1080740).
• Fixed lsblk on NVMe (bsc#1078662).

This update for util-linux fixes the following issues:

• CVE-2018-7738: Fixed shell code injection in umount bash-completions. (bsc#1213865, bsc#1084300)

This update for util-linux fixes the following issues:

• CVE-2018-7738: Fixed shell code injection in umount bash-completions (bsc#1213865).

This update for util-linux fixes the following issues:

• CVE-2018-7738: Fixed shell code injection in umount bash-completions (bsc#1213865).

It was discovered that the umount bash completion script shipped in util-linux incorrectly handled certain mountpoints. If a local attacker were able to create arbitrary mountpoints, another user could be tricked into executing arbitrary code when attempting to run the umount command with bash completion.