Package: mount Version: 2.29.2-1 Severity: normal Tags: security Debugging of libmount can be activated, also in SUID binaries, thus spilling out the heap addresses. Note that "CXT" structure contains function pointers to overwrite.
Test: LIBMOUNT_DEBUG=all /bin/umount / Output: 2401: libmount: CXT: [0x562d3abb0760]: ----> allocate [RESTRICTED] 2401: libmount: CXT: [0x562d3abb0760]: umount: / 2401: libmount: CXT: [0x562d3abb0760]: umount: lookup FS for '/' 2401: libmount: CXT: [0x562d3abb0760]: checking for writable tab files 2401: libmount: UTILS: utab: /run/mount/utab 2401: libmount: CACHE: [0x562d3abb1950]: alloc 2401: libmount: CACHE: [0x562d3abb1950]: canonicalize path / 2401: libmount: CACHE: [0x562d3abb1950]: add entry [ 1] (path): /: / 2401: libmount: CXT: [0x562d3abb0760]: tabfilter ENABLED! 2401: libmount: TAB: [0x562d3abb35b0]: alloc ... The output can easily be used by creating a local domain socket with only 4k buffer size, filling it up until writes are blocking and then start umount with that socket as stdout. This allows race-free reading of the address output before umount accesses other user-controlled resource. Thus any error during the downstream procedure creating some kind of write-where vulnerability will always find the correct target. See also: * https://www.spinics.net/lists/util-linux-ng/msg14978.html * https://bugzilla.redhat.com/show_bug.cgi?id=1534076
