CVE-2005-2876 (CNNVD-200509-103)
HIGH
中文标题:
Linux umount命令权限提升漏洞
英文标题:
umount in util-linux 2.8 to 2.12q, 2.13-pre1, and 2.13-pre2, and other packages such as loop-aes-uti...
CVSS分数:
7.2
发布时间:
2005-09-13 04:00:00
漏洞类型:
授权问题
状态:
PUBLISHED
数据质量分数:
0.30
数据版本:
v3
漏洞描述
中文描述:
util-linux包包含各种底层系统工具，用于实现Linux的基本功能。 umount在处理文件卸载时存在漏洞，本地攻击者可能利用此漏洞获取root用户权限。在加载系统文件时，util-linux包中的mount命令默认下总是设置了nosuid和nodev标记，仅有超级用户或fstab项中的明确设置才能覆盖这个标签。但是，umount命令允许用户使用-r选项删除这些标签。在系统繁忙无法完全卸载文件系统时(如进程的当前目录)，-r选项会要求umount只读重新加载文件系统，但仅以MS_RDONLY ("ro")标签重新加载，这样就清除了所有其他标签，包括nosuid和nodev。成功利用这个漏洞的攻击者可以使用-r选项强制不安全的重新加载，获得root权限。
英文描述:
umount in util-linux 2.8 to 2.12q, 2.13-pre1, and 2.13-pre2, and other packages such as loop-aes-utils, allows local users with unmount permissions to gain privileges via the -r (remount) option, which causes the file system to be remounted with just the read-only flag, which effectively clears the nosuid, nodev, and other flags.
CWE类型:
（暂无数据）
标签:
（暂无数据）
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| andries_brouwer | util-linux | 2.8.1_alpha | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.8.1_alpha:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.8_12 | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.8_12:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.9i | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.9i:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.9w | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.9w:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.10f | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.10f:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.10m | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.10m:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.10p | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.10p:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.11f | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.11f:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.11n | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.11n:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.11q | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.11q:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.11r | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.11r:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.11w | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.11w:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.11x | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.11x:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.11y | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.11y:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.11z | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.11z:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.12a | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.12a:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.12b | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.12b:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.12i | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.12i:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.12j | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.12j:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.12k | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.12k:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.12o | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.12o:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.12p | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.12p:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.12q | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.12q:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.13_pre1 | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.13_pre1:*:*:*:*:*:*:*
|
| andries_brouwer | util-linux | 2.13_pre2 | - | - |
cpe:2.3:a:andries_brouwer:util-linux:2.13_pre2:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
101960
vendor-advisory
cve.org
访问
cve.org
17133
third-party-advisory
cve.org
访问
cve.org
FLSA:168326
vendor-advisory
cve.org
访问
cve.org
utillinux-umount-gain-privileges(22241)
vdb-entry
cve.org
访问
cve.org
19369
vdb-entry
cve.org
访问
cve.org
DSA-823
vendor-advisory
cve.org
访问
cve.org
SUSE-SR:2005:021
vendor-advisory
cve.org
访问
cve.org
16785
third-party-advisory
cve.org
访问
cve.org
2005-0049
vendor-advisory
cve.org
访问
cve.org
16988
third-party-advisory
cve.org
访问
cve.org
DSA-825
vendor-advisory
cve.org
访问
cve.org
17154
third-party-advisory
cve.org
访问
cve.org
USN-184
vendor-advisory
cve.org
访问
cve.org
无标题
x_refsource_MISC
cve.org
访问
cve.org
18502
third-party-advisory
cve.org
访问
cve.org
oval:org.mitre.oval:def:10921
vdb-entry
cve.org
访问
cve.org
17027
third-party-advisory
cve.org
访问
cve.org
20050912 util-linux: unintentional grant of privileges by umount
mailing-list
cve.org
访问
cve.org
17004
third-party-advisory
cve.org
访问
cve.org
14816
vdb-entry
cve.org
访问
cve.org
CVSS评分详情
7.2
HIGH
CVSS向量:
AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS版本:
2.0
机密性
COMPLETE
完整性
COMPLETE
可用性
COMPLETE
时间信息
发布时间:
2005-09-13 04:00:00
修改时间:
2024-08-07 22:53:28
创建时间:
2025-11-11 15:32:28
更新时间:
2025-11-11 15:49:00
利用信息
暂无可利用代码信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2005-2876 |
2025-11-11 15:17:35 | 2025-11-11 07:32:28 |
| NVD | nvd_CVE-2005-2876 |
2025-11-11 14:51:20 | 2025-11-11 07:41:14 |
| CNNVD | cnnvd_CNNVD-200509-103 |
2025-11-11 15:08:48 | 2025-11-11 07:49:00 |
版本与语言
当前版本:
v3
主要语言:
EN
支持语言:
EN
ZH
安全公告
暂无安全公告信息
变更历史
v3
CNNVD
2025-11-11 15:49:00
vulnerability_type: 未提取 → 授权问题; cnnvd_id: 未提取 → CNNVD-200509-103; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-200509-103
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2
NVD
2025-11-11 15:41:14
severity: SeverityLevel.MEDIUM → SeverityLevel.HIGH; cvss_score: 未提取 → 7.2; cvss_vector: NOT_EXTRACTED → AV:L/AC:L/Au:N/C:C/I:C/A:C; cvss_version: NOT_EXTRACTED → 2.0; affected_products_count: 0 → 25; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
- severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
- cvss_score: 未提取 -> 7.2
- cvss_vector: NOT_EXTRACTED -> AV:L/AC:L/Au:N/C:C/I:C/A:C
- cvss_version: NOT_EXTRACTED -> 2.0
- affected_products_count: 0 -> 25
- data_sources: ['cve'] -> ['cve', 'nvd']