Detections
Analytics

EulerOS Virtualization 2.11.1 : util-linux (EulerOS-SA-2026-3479)

medium Nessus Plugin ID 347190

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.(CVE-2025-14104)

 A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names.
 This could lead to unauthorized access.(CVE-2026-3184)

 util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check- Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.(CVE-2026-27456)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization util-linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected util-linux packages.

See Also

http://www.nessus.org/u?52c3c446

Plugin Details

Severity: Medium

ID: 347190

File Name: EulerOS_SA-2026-3479.nasl

Version: 1.1

Type: Local

Published: 9/18/2026

Updated: 9/18/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6

Percentile: 96.69

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-3184

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:huawei:euleros:uvp:2.11.1, p-cpe:/a:huawei:euleros:libblkid, p-cpe:/a:huawei:euleros:libfdisk, p-cpe:/a:huawei:euleros:libmount, p-cpe:/a:huawei:euleros:libsmartcols, p-cpe:/a:huawei:euleros:libuuid, p-cpe:/a:huawei:euleros:util-linux-user, p-cpe:/a:huawei:euleros:util-linux

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/uvp_version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/16/2026

Vulnerability Publication Date: 12/5/2025

Reference Information

CVE: CVE-2025-14104, CVE-2026-27456, CVE-2026-3184

IAVA: 2026-A-0384