CVE-2019-3461

HIGH

Debian tmpreaper 1.6.13+nmu1 - Local Privilege Escalation via Race Condition in Mount Rename

Title source: llm

Description

Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in local privilege escalation. Mounting via rename() could potentially lead to a file being placed elsewhereon the filesystem hierarchy (e.g. /etc/cron.d/) if the directory being cleaned up was on the same physical filesystem. Fixed versions include 1.6.13+nmu1+deb9u1 and 1.6.14.

References (4)

Core 4

Core References

Vendor Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2019/01/msg00017.html

Mailing List, Vendor Advisory x_refsource_misc

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=918956

Mailing List, Vendor Advisory vendor-advisory x_refsource_debian

https://lists.debian.org/debian-security-announce/2019/msg00003.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/4077-1/

Scores

CVSS v3 7.0

EPSS 0.0025

EPSS Percentile 16.3%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-362

Status published

Products (3)

debian/debian_linux 8.0

debian/debian_linux 9.0

debian/tmpreaper 1.6.13\+nmu1

Published Feb 04, 2019

Tracked Since Feb 18, 2026