PT-2024-21517 · Linux+1 · Linux Kernel+1

Published 2024-04-17 · Updated 2024-05-16 · CVE-2024-26821

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability has been resolved in the Linux kernel related to the mount setattr() function, which had stricter permission checks compared to the legacy do reconfigure mnt() and do change type() helpers. The issue arose because the real rootfs does not fit into the categories of anonymous mounts or mounts with a parent, causing mount setattr(2) to block changes to mount properties on the real rootfs, whereas legacy mount(2) allowed such changes. This issue was surfaced when util-linux switched to the new mount API in version 2.39.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2024-26821

Affected Products

Linux Kernel

Util-Linux

References · 11

• https://ubuntu.com/security/CVE-2024-26821 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-26821 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-26821 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26821 · Security Note
• https://git.kernel.org/stable/c/46f5ab762d048dad224436978315cbc2fa79c630 · Note
• https://git.kernel.org/stable/c/2a7a31e1fb9717845d9d5e2a8c6e48848147801e · Note
• https://git.kernel.org/linus/46f5ab762d048dad224436978315cbc2fa79c630 · Note
• https://t.me/cvenotify/77052 · Telegram Post
• https://git.kernel.org/stable/c/95de4ad173ca0e61034f3145d66917970961c210 · Note
• https://git.kernel.org/stable/c/31f71f2d7a081fc6c6bdf06865beedf6db5b0ca4 · Note
• https://twitter.com/CVEnew/status/1780731161184247921 · Twitter Post