CVE-2018-7738
bsdutils: In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell comman...
CVE-2018-7738 is fixed in 13 products on 1 platform, first by bsdutils 1:2.31.1-0.4ubuntu3.7, released March 6, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Negligible
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0043
37th percentile
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| bsdutils · Ubuntu 18.04.6 LTS (bionic) | 1:2.31.1-0.4ubuntu3.7 | bsdutils 1:2.31.1-0.4ubuntu3.7 | Mar 6, 2018 |
| fdisk · Ubuntu 18.04.6 LTS (bionic) | 2.31.1-0.4ubuntu3.7 | fdisk 2.31.1-0.4ubuntu3.7 | Mar 6, 2018 |
| libblkid1 · Ubuntu 18.04.6 LTS (bionic) | 2.31.1-0.4ubuntu3.7 | libblkid1 2.31.1-0.4ubuntu3.7 | Mar 6, 2018 |
| libfdisk1 · Ubuntu 18.04.6 LTS (bionic) | 2.31.1-0.4ubuntu3.7 | libfdisk1 2.31.1-0.4ubuntu3.7 | Mar 6, 2018 |
| libmount1 · Ubuntu 18.04.6 LTS (bionic) | 2.31.1-0.4ubuntu3.7 | libmount1 2.31.1-0.4ubuntu3.7 | Mar 6, 2018 |
| libsmartcols1 · Ubuntu 18.04.6 LTS (bionic) | 2.31.1-0.4ubuntu3.7 | libsmartcols1 2.31.1-0.4ubuntu3.7 | Mar 6, 2018 |
| libuuid1 · Ubuntu 18.04.6 LTS (bionic) | 2.31.1-0.4ubuntu3.7 | libuuid1 2.31.1-0.4ubuntu3.7 | Mar 6, 2018 |
| mount · Ubuntu 18.04.6 LTS (bionic) | 2.31.1-0.4ubuntu3.7 | mount 2.31.1-0.4ubuntu3.7 | Mar 6, 2018 |
| rfkill · Ubuntu 18.04.6 LTS (bionic) | 2.31.1-0.4ubuntu3.7 | rfkill 2.31.1-0.4ubuntu3.7 | Mar 6, 2018 |
| setpriv · Ubuntu 18.04.6 LTS (bionic) | 2.31.1-0.4ubuntu3.7 | setpriv 2.31.1-0.4ubuntu3.7 | Mar 6, 2018 |
| util-linux · Ubuntu 18.04.6 LTS (bionic) | 2.31.1-0.4ubuntu3.7 | util-linux 2.31.1-0.4ubuntu3.7 | Mar 6, 2018 |
| util-linux-locales · Ubuntu 18.04.6 LTS (bionic) | 2.31.1-0.4ubuntu3.7 | util-linux-locales 2.31.1-0.4ubuntu3.7 | Mar 6, 2018 |
| uuid-runtime · Ubuntu 18.04.6 LTS (bionic) | 2.31.1-0.4ubuntu3.7 | uuid-runtime 2.31.1-0.4ubuntu3.7 | Mar 6, 2018 |