Description

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-02T16:17:23.983Z",
  "pubdate": "2026-09-02T16:17:23.983Z",
  "executiveSummary": "A local privilege escalation vulnerability exists in util-linux due to improper validation of bind mount source paths. The vulnerability arises because the SUID mount(8) utility fails to pin the source path defined in fstab before executing the mount operation, allowing an unprivileged user to manipulate the filesystem structure.\nBy replacing the expected source path or a writable parent directory with a symbolic link or a malicious directory structure after the check but before the mount, an attacker can trick the privileged mount(8) process into binding an arbitrary host directory.\nIf the fstab entry specifies ownership (X-mount.owner), group (X-mount.group), or permission mode (X-mount.mode) parameters, the privileged process will inadvertently apply these security attributes to the target inode of the attacker's choosing. This flaw facilitates potential privilege escalation, unauthorized access to sensitive filesystem locations, and the ability to modify ownership or permissions of system-critical files.\nThe vulnerability is limited to local exploitation by an unprivileged user capable of modifying or replacing directories specified within the fstab configuration. Successful exploitation requires the presence of specific mount options and local filesystem access, presenting a significant security risk to multi-user environments where users possess partial control over mount configurations.",
  "technicalDetails": "The root cause of this vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition within the mount(8) binary. When processing an entry from fstab, the utility reads the source path; however, it fails to perform an atomic operation to lock or pin the directory inode, creating a window of opportunity for an attacker.\nThe attack flow proceeds as follows: First, an attacker identifies an fstab entry that grants non-root users the ability to mount a directory, particularly one utilizing the 'user' or 'users' option alongside security-sensitive flags like 'X-mount.owner', 'X-mount.group', or 'X-mount.mode'.\nSecond, the attacker prepares a malicious filesystem structure. If the source path is located in a directory where the attacker has write access—or if the attacker can influence the parent directory of the source—they replace the intended source path with a symbolic link pointing to a sensitive system file or directory (e.g., /etc/shadow or /etc/sudoers) immediately after the mount(8) utility performs its initial security validation.\nThird, the mount(8) utility, executing with SUID root privileges, proceeds to bind the directory. Because it does not operate on a file descriptor pinned to the original validated inode, it follows the attacker's symbolic link and performs the bind mount on the unintended target.\nFourth, if the fstab entry includes parameters such as 'X-mount.owner' or 'X-mount.mode', the mount(8) process will automatically invoke chown or chmod system calls on the target inode after the bind mount is established. By redirecting the mount target to an arbitrary file, the attacker forces the privileged process to alter the ownership or permissions of system files to values specified in the fstab entry.\nThe post-exploitation impact is severe: an unprivileged user can gain ownership of files they should not access, modify permissions to grant themselves write access to configuration files, or bypass existing security restrictions on system files. This effectively results in full system compromise. Because the vulnerability depends on the SUID nature of the mount binary and the execution of specific fstab parameters, the exposure is strictly local, requiring the attacker to have at least minimal access to a shell on the target system."
}