Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Apr 2011 16:56:43 +0200
From: Tomas Hoger <>
Cc:, Ludwig Nussel <>,
        Petr Baudis <>
Subject: Re: Suid mount helpers fail to anticipate

On Tue, 15 Mar 2011 09:13:00 -0400 Dan Rosenberg wrote:

> util-linux mount
> =============
> * Edits /etc/mtab.tmp with custom my_addmntent(), behaves identically
> to glibc addmntent() in terms of return code
> * Succeeds on partial writes, does not remove temp file on failure
> (could result in additional corruption of /etc/mtab through multiple
> invocations), does not remove lock file /etc/mtab~ on failure (also an
> issue)

Dan, would you mind clarifying the way to achieve mtab corruption via
truncated left-over mtab.tmp file and multiple invocations?  After some
discussion with our util-linux maintainer, we fail to see an obvious
way.  util-linux opens mtab.tmp using "w" fopen open, i.e. using O_TRUNC
open flag.  So if there's any mtab.tmp file found, it's overwritten and
its existence does not block further use of mount / umount as existence
of mtab~ lock file does.

Thank you!

Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.