Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 03 Feb 2011 11:45:35 -0500
From: Marc Deslauriers <>
Subject: Re: CVE request: fuse

On Thu, 2011-02-03 at 11:17 -0500, Josh Bressers wrote:
> ----- Original Message -----
> > 
> > A few more fixes have made their way to FUSE to prevent TOCTTOU symlink
> > attacks. An unprivileged user was able to unmount arbitrary mounts:
> > 
> >;a=commit;h=bf5ffb5fd8558bd799791834def431c0cee5a11f
> >;a=commit;h=1e7607ff89c65b005f69e27aeb1649d624099873
> >;a=commit;h=cbd3a2a84068aae6e3fe32939d88470d712dbf47
> > 
> > Could we please get one or more CVE numbers for them?
> > 
> I don't understand what these flaws are just by reading the commit
> messages. Can you explain them?
> Thanks.


Fuse tries to mount a directory without resolving symlinks, and then
tries to update mtab. If it couldn't update mtab, it would unmount the
directory while resolving symlinks this time, resulting in a different
directory being unmounted.;a=commit;h=1e7607ff89c65b005f69e27aeb1649d624099873

This prevents local users from changing the location of the current
directory from under fuse using a timing attack.;a=commit;h=cbd3a2a84068aae6e3fe32939d88470d712dbf47

Fuse uses the --no-canonicalize mount option to prevent a symlink attack
on the mount point written to mtab. For backwards compatibility reasons,
it would fallback to using mount in an insecure way. This fallback could
get triggered by a user when an entry already existed in mtab.

All three of these issues allowed local users to trick fuse into
unmounting arbitrary directories.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.