util-linux (u)mount doesn't drop privileges properly when calling helpers

🗓️ 15 Nov 2007 16:07:00Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 2 Views

util-linux mount and unmount fail to drop privileges when calling helpers, risking privilege escalation via mount.nfs.

Reporter	Title	Published	Views	Family All 74
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a malicious individual to compromise the confidentiality, integrity, and accessibility of protected information	6 Jul 201600:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a malicious individual to compromise the confidentiality, integrity, and accessibility of protected information	6 Jul 201600:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a local malicious individual to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a local malicious individual to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a local malicious individual to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a local malicious individual to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a local malicious individual to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a local malicious individual to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	3	i386	losetup	0:2.11y-31.24	losetup-0:2.11y-31.24.i386.rpm
Red Hat Enterprise Linux	3	ia64	losetup	0:2.11y-31.24	losetup-0:2.11y-31.24.ia64.rpm
Red Hat Enterprise Linux	3	ppc	losetup	0:2.11y-31.24	losetup-0:2.11y-31.24.ppc.rpm
Red Hat Enterprise Linux	3	s390	losetup	0:2.11y-31.24	losetup-0:2.11y-31.24.s390.rpm
Red Hat Enterprise Linux	3	s390x	losetup	0:2.11y-31.24	losetup-0:2.11y-31.24.s390x.rpm
Red Hat Enterprise Linux	3	x86_64	losetup	0:2.11y-31.24	losetup-0:2.11y-31.24.x86_64.rpm
Red Hat Enterprise Linux	3	i386	mount	0:2.11y-31.24	mount-0:2.11y-31.24.i386.rpm
Red Hat Enterprise Linux	3	ia64	mount	0:2.11y-31.24	mount-0:2.11y-31.24.ia64.rpm
Red Hat Enterprise Linux	3	ppc	mount	0:2.11y-31.24	mount-0:2.11y-31.24.ppc.rpm
Red Hat Enterprise Linux	3	s390	mount	0:2.11y-31.24	mount-0:2.11y-31.24.s390.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2007-5191
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2007-5191
cve	www.cve.org/CVERecord

21 Nov 2025 17:32Current

5.8Medium risk

Vulners AI Score5.8

CVSS 27.2

EPSS0.00101

privilege escalation mount helpers set user id set group id ignore return values mount nfs