Vulnerability in Kernel Util-linux
CVE-2007-5191
mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs.
EPSS: 0.004 (35.7th percentile) — read the EPSS interpretation.
Affected products
- Kernel Util-linux
- Loop-aes-utils_project Loop-aes-utils
- Canonical Ubuntu_linux — versions 6.06, 6.10, 7.04
- Debian Debian_linux — versions 3.1
- Fedoraproject Fedora — versions 7
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Broken Link)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_MANDRIVA)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
Frequently asked questions
- What is CVE-2007-5191?
- CVE-2007-5191 is a vulnerability in Kernel Util-linux, classified under CWE-252. Published 2007-10-04.
- Is CVE-2007-5191 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.