CVE-2015-3202
Description
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Fuse 2.9.3-15 - Local Privilege Escalation
OS impact
SUSE Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Affected | — |
Debian Mixed 6 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 2.9.3-16 |
| sid | Fixed | 2.9.3-16 |
| forky | Fixed | 1:2014.2.15AR.3-3 |
| bullseye | Fixed | 2.9.3-16 |
| bookworm | Fixed | 2.9.3-16 |
| 8.0 | Affected | — |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| fuse_project | fuse | {"endIncluding":"2.9.2"} | |
References
- https://www.suse.com/security/cve/CVE-2015-3202.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159298.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159543.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159683.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159831.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160094.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160106.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00005.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00007.html
- http://packetstormsecurity.com/files/132021/Fuse-Local-Privilege-Escalation.html
- http://www.debian.org/security/2015/dsa-3266
- http://www.debian.org/security/2015/dsa-3268
- http://www.openwall.com/lists/oss-security/2015/05/21/9
- http://www.securityfocus.com/bid/74765
- http://www.securitytracker.com/id/1032386
- http://www.ubuntu.com/usn/USN-2617-1
- http://www.ubuntu.com/usn/USN-2617-2
- http://www.ubuntu.com/usn/USN-2617-3
- https://gist.github.com/taviso/ecb70eb12d461dd85cba
- https://security.gentoo.org/glsa/201603-04
- https://security.gentoo.org/glsa/201701-19
- https://twitter.com/taviso/status/601370527437967360
- https://www.exploit-db.com/exploits/37089/
- https://security-tracker.debian.org/tracker/CVE-2015-3202
CWEs
CWE-264
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.