Detections
Analytics

Echo: util-linux: security update to 2.41.5-0+deb13u1+e1

medium Tenable Cloud Security Plugin ID 458500

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-
 Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The
 mount binary, when setting up loop devices, validates the source file path with user privileges via fork()
 + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0)
 without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor
 inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the
 source file with a symlink pointing to any root-owned file or device during the race window, causing the
 SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options
 whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the
 SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized
 read access to root-protected files and block devices, including backup images, disk volumes, and any file
 containing a valid filesystem. This issue has been patched in version 2.41.4. (CVE-2026-27456)

Solution

Update the util-linux library and its related packages to version 2.41.5-0+deb13u1+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-27456

Plugin Details

Severity: Medium

ID: 458500

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6

Percentile: 96.69

CVSS v2

Risk Factor: Low

Base Score: 3.8

Temporal Score: 3

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2026-27456

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.2

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/3/2026

Vulnerability Publication Date: 4/1/2026

Reference Information

CVE: CVE-2026-27456

IAVA: 2026-A-0384