ALAS2022-2022-099


Amazon Linux 2022 Security Advisory: ALAS-2022-099
Advisory Release Date: 2022-06-28 23:52 Pacific
Advisory Updated Date: 2022-07-19 19:44 Pacific
Severity: Medium

Issue Overview:

A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems. (CVE-2021-3995)

A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems. (CVE-2021-3996)

A flaw was found in the Linux kernel's util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. (CVE-2022-0563)


Affected Packages:

util-linux


Issue Correction:
Run dnf update --releasever=2022.0.20220628 util-linux to update your system.

New Packages:
aarch64:
    libblkid-debuginfo-2.37.4-1.amzn2022.aarch64
    libblkid-devel-2.37.4-1.amzn2022.aarch64
    libsmartcols-2.37.4-1.amzn2022.aarch64
    libuuid-devel-2.37.4-1.amzn2022.aarch64
    uuidd-debuginfo-2.37.4-1.amzn2022.aarch64
    util-linux-user-2.37.4-1.amzn2022.aarch64
    util-linux-core-debuginfo-2.37.4-1.amzn2022.aarch64
    libmount-devel-2.37.4-1.amzn2022.aarch64
    libsmartcols-devel-2.37.4-1.amzn2022.aarch64
    uuidd-2.37.4-1.amzn2022.aarch64
    python3-libmount-debuginfo-2.37.4-1.amzn2022.aarch64
    libmount-debuginfo-2.37.4-1.amzn2022.aarch64
    libfdisk-2.37.4-1.amzn2022.aarch64
    libmount-2.37.4-1.amzn2022.aarch64
    util-linux-user-debuginfo-2.37.4-1.amzn2022.aarch64
    libfdisk-devel-2.37.4-1.amzn2022.aarch64
    util-linux-core-2.37.4-1.amzn2022.aarch64
    util-linux-debuginfo-2.37.4-1.amzn2022.aarch64
    python3-libmount-2.37.4-1.amzn2022.aarch64
    libsmartcols-debuginfo-2.37.4-1.amzn2022.aarch64
    util-linux-debugsource-2.37.4-1.amzn2022.aarch64
    libuuid-2.37.4-1.amzn2022.aarch64
    util-linux-2.37.4-1.amzn2022.aarch64
    libuuid-debuginfo-2.37.4-1.amzn2022.aarch64
    libblkid-2.37.4-1.amzn2022.aarch64
    libfdisk-debuginfo-2.37.4-1.amzn2022.aarch64

src:
    util-linux-2.37.4-1.amzn2022.src

x86_64:
    libmount-debuginfo-2.37.4-1.amzn2022.x86_64
    python3-libmount-debuginfo-2.37.4-1.amzn2022.x86_64
    uuidd-debuginfo-2.37.4-1.amzn2022.x86_64
    libsmartcols-debuginfo-2.37.4-1.amzn2022.x86_64
    libsmartcols-2.37.4-1.amzn2022.x86_64
    util-linux-debugsource-2.37.4-1.amzn2022.x86_64
    libsmartcols-devel-2.37.4-1.amzn2022.x86_64
    util-linux-core-debuginfo-2.37.4-1.amzn2022.x86_64
    libblkid-2.37.4-1.amzn2022.x86_64
    libfdisk-devel-2.37.4-1.amzn2022.x86_64
    uuidd-2.37.4-1.amzn2022.x86_64
    util-linux-debuginfo-2.37.4-1.amzn2022.x86_64
    libuuid-debuginfo-2.37.4-1.amzn2022.x86_64
    libblkid-devel-2.37.4-1.amzn2022.x86_64
    util-linux-user-2.37.4-1.amzn2022.x86_64
    libuuid-2.37.4-1.amzn2022.x86_64
    libuuid-devel-2.37.4-1.amzn2022.x86_64
    util-linux-core-2.37.4-1.amzn2022.x86_64
    libmount-devel-2.37.4-1.amzn2022.x86_64
    libblkid-debuginfo-2.37.4-1.amzn2022.x86_64
    util-linux-2.37.4-1.amzn2022.x86_64
    libmount-2.37.4-1.amzn2022.x86_64
    libfdisk-debuginfo-2.37.4-1.amzn2022.x86_64
    util-linux-user-debuginfo-2.37.4-1.amzn2022.x86_64
    python3-libmount-2.37.4-1.amzn2022.x86_64
    libfdisk-2.37.4-1.amzn2022.x86_64