Amazon Linux 2023 Security Advisory: ALAS-2023-024
Advisory Release Date: 2023-02-17 20:43 Pacific
Advisory Updated Date: 2023-02-22 23:54 Pacific
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems. (CVE-2021-3995)
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems. (CVE-2021-3996)
A flaw was found in the Linux kernel's util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an INPUTRC environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. (CVE-2022-0563)
Affected Packages:
util-linux
Issue Correction:
Run dnf update util-linux --releasever=2023.0.20230222 to update your system.
aarch64:
libblkid-debuginfo-2.37.4-1.amzn2023.0.3.aarch64
util-linux-user-debuginfo-2.37.4-1.amzn2023.0.3.aarch64
python3-libmount-2.37.4-1.amzn2023.0.3.aarch64
libsmartcols-debuginfo-2.37.4-1.amzn2023.0.3.aarch64
libuuid-2.37.4-1.amzn2023.0.3.aarch64
python3-libmount-debuginfo-2.37.4-1.amzn2023.0.3.aarch64
util-linux-core-debuginfo-2.37.4-1.amzn2023.0.3.aarch64
libmount-debuginfo-2.37.4-1.amzn2023.0.3.aarch64
libblkid-devel-2.37.4-1.amzn2023.0.3.aarch64
libblkid-2.37.4-1.amzn2023.0.3.aarch64
util-linux-core-2.37.4-1.amzn2023.0.3.aarch64
libuuid-devel-2.37.4-1.amzn2023.0.3.aarch64
uuidd-2.37.4-1.amzn2023.0.3.aarch64
util-linux-debuginfo-2.37.4-1.amzn2023.0.3.aarch64
uuidd-debuginfo-2.37.4-1.amzn2023.0.3.aarch64
libsmartcols-devel-2.37.4-1.amzn2023.0.3.aarch64
libmount-2.37.4-1.amzn2023.0.3.aarch64
libfdisk-devel-2.37.4-1.amzn2023.0.3.aarch64
util-linux-2.37.4-1.amzn2023.0.3.aarch64
libfdisk-debuginfo-2.37.4-1.amzn2023.0.3.aarch64
libsmartcols-2.37.4-1.amzn2023.0.3.aarch64
util-linux-user-2.37.4-1.amzn2023.0.3.aarch64
libmount-devel-2.37.4-1.amzn2023.0.3.aarch64
libuuid-debuginfo-2.37.4-1.amzn2023.0.3.aarch64
util-linux-debugsource-2.37.4-1.amzn2023.0.3.aarch64
libfdisk-2.37.4-1.amzn2023.0.3.aarch64
src:
util-linux-2.37.4-1.amzn2023.0.3.src
x86_64:
libmount-debuginfo-2.37.4-1.amzn2023.0.3.x86_64
python3-libmount-debuginfo-2.37.4-1.amzn2023.0.3.x86_64
libblkid-debuginfo-2.37.4-1.amzn2023.0.3.x86_64
util-linux-user-debuginfo-2.37.4-1.amzn2023.0.3.x86_64
libuuid-debuginfo-2.37.4-1.amzn2023.0.3.x86_64
libblkid-devel-2.37.4-1.amzn2023.0.3.x86_64
python3-libmount-2.37.4-1.amzn2023.0.3.x86_64
libblkid-2.37.4-1.amzn2023.0.3.x86_64
uuidd-debuginfo-2.37.4-1.amzn2023.0.3.x86_64
util-linux-core-2.37.4-1.amzn2023.0.3.x86_64
libmount-2.37.4-1.amzn2023.0.3.x86_64
libmount-devel-2.37.4-1.amzn2023.0.3.x86_64
libuuid-2.37.4-1.amzn2023.0.3.x86_64
libsmartcols-debuginfo-2.37.4-1.amzn2023.0.3.x86_64
util-linux-core-debuginfo-2.37.4-1.amzn2023.0.3.x86_64
libsmartcols-devel-2.37.4-1.amzn2023.0.3.x86_64
libsmartcols-2.37.4-1.amzn2023.0.3.x86_64
util-linux-user-2.37.4-1.amzn2023.0.3.x86_64
libfdisk-devel-2.37.4-1.amzn2023.0.3.x86_64
util-linux-debugsource-2.37.4-1.amzn2023.0.3.x86_64
uuidd-2.37.4-1.amzn2023.0.3.x86_64
util-linux-debuginfo-2.37.4-1.amzn2023.0.3.x86_64
libfdisk-debuginfo-2.37.4-1.amzn2023.0.3.x86_64
libuuid-devel-2.37.4-1.amzn2023.0.3.x86_64
libfdisk-2.37.4-1.amzn2023.0.3.x86_64
util-linux-2.37.4-1.amzn2023.0.3.x86_64