A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - util-linux: runuser tty hijack via TIOCSTI ioctl (CVE-2016-2779)

  - An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute     arbitrary commands via the path parameter when setting the date. (CVE-2020-21583)

  - An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker     were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file.
    NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.
    (CVE-2021-37600)

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline     (CVE-2022-0563)

  - The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows     physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS     partition table with an extended partition boot record at zero offset. (CVE-2016-5011)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the util-linux-2.37.4-3.el9 build changelog.

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202401-08 (util-linux: Multiple Vulnerabilities)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker     were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file.
    NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments     (CVE-2021-37600)

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-024 advisory.

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of util-linux installed on the remote host is prior to 2.37.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-218 advisory.

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of util-linux installed on the remote host is prior to 2.30.2-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1901 advisory.

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an 'INPUTRC' environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-099 advisory.

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the util-linux package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an 'INPUTRC' environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

  - A logical error was found in util-linux's libmount library in a function that allows unprivileged users to     unmount FUSE filesystems. Incorrect uid checking allows unprivileged users to unmount FUSE filesystems     with similar uid users, an attacker could exploit this vulnerability to cause a denial of (CVE-2021-3995)

  - that allows unprivileged users to unmount FUSE filesystems. Issues related to parsing the     /proc/self/mountinfo file allow unprivileged users to unmount other users' filesystems that are themselves     world-writable (such as /tmp) or mounted in a world-writable directory. An attacker could exploit this     (CVE-2021-3996)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an 'INPUTRC' environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of util-linux installed on the remote host is prior to 2.37.4. It is, therefore, affected by a vulnerability as referenced in the SSA:2022-046-02 advisory.

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196200	RHEL 7 : util-linux (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196197	RHEL 6 : util-linux (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
191356	CentOS 9 : util-linux-2.37.4-3.el9	Nessus	CentOS Local Security Checks	medium
187668	GLSA-202401-08 : util-linux: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
173184	Amazon Linux 2023 : libblkid, libblkid-devel, libfdisk (ALAS2023-2023-024)	Nessus	Amazon Linux Local Security Checks	medium
168590	Amazon Linux 2022 : util-linux (ALAS2022-2022-218)	Nessus	Amazon Linux Local Security Checks	medium
168441	Amazon Linux 2 : util-linux (ALAS-2022-1901)	Nessus	Amazon Linux Local Security Checks	medium
165925	EulerOS Virtualization 3.0.6.0 : util-linux (EulerOS-SA-2022-2593)	Nessus	Huawei Local Security Checks	medium
164772	Amazon Linux 2022 : (ALAS2022-2022-099)	Nessus	Amazon Linux Local Security Checks	medium
163625	EulerOS Virtualization 2.9.0 : util-linux (EulerOS-SA-2022-2211)	Nessus	Huawei Local Security Checks	medium
163600	EulerOS Virtualization 2.9.1 : util-linux (EulerOS-SA-2022-2192)	Nessus	Huawei Local Security Checks	medium
163219	EulerOS Virtualization 2.10.1 : util-linux (EulerOS-SA-2022-2069)	Nessus	Huawei Local Security Checks	medium
163197	EulerOS Virtualization 2.10.0 : util-linux (EulerOS-SA-2022-2041)	Nessus	Huawei Local Security Checks	medium
162256	EulerOS 2.0 SP9 : util-linux (EulerOS-SA-2022-1855)	Nessus	Huawei Local Security Checks	medium
162251	EulerOS 2.0 SP9 : util-linux (EulerOS-SA-2022-1879)	Nessus	Huawei Local Security Checks	medium
161862	EulerOS 2.0 SP10 : util-linux (EulerOS-SA-2022-1815)	Nessus	Huawei Local Security Checks	medium
161851	EulerOS 2.0 SP10 : util-linux (EulerOS-SA-2022-1798)	Nessus	Huawei Local Security Checks	medium
160144	EulerOS 2.0 SP8 : util-linux (EulerOS-SA-2022-1590)	Nessus	Huawei Local Security Checks	medium
158105	Slackware Linux 15.0 / current util-linux Vulnerability (SSA:2022-046-02)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2022-0563

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium