CVE-2015-3202

FUSE <2.9.3-15 - Local Privilege Escalation

Title source: llm

Description

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Tavis Ormandy · textlocallinux

https://www.exploit-db.com/exploits/37089

View Code ZIP pw:eip

References (22)

[Mailing List] http://lists.opensuse.org/opensuse-updates/2015-06/msg00005.html

[Mailing List] http://lists.opensuse.org/opensuse-updates/2015-06/msg00007.html

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/132021/Fuse-Local-Privilege-Escalation.html

[Exploit] http://www.openwall.com/lists/oss-security/2015/05/21/9

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1032386

[Vendor Advisory] http://www.ubuntu.com/usn/USN-2617-1

[Vendor Advisory] http://www.ubuntu.com/usn/USN-2617-2

[Vendor Advisory] http://www.ubuntu.com/usn/USN-2617-3

[Exploit] https://gist.github.com/taviso/ecb70eb12d461dd85cba

[Various Sources] https://twitter.com/taviso/status/601370527437967360

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/74765

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159298.html

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159543.html

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159683.html

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159831.html

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160094.html

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160106.html

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/37089/

[Third Party Advisory] http://www.debian.org/security/2015/dsa-3266

[Third Party Advisory] http://www.debian.org/security/2015/dsa-3268

... and 2 more

Scores

EPSS 0.0034

EPSS Percentile 56.0%

Classification

CWE

CWE-264

Status draft

Affected Products (2)

debian/debian_linux

fuse_project/fuse < 2.9.2

Timeline

Published Jul 02, 2015

Tracked Since Feb 18, 2026