CVE-2019-3461

Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in local privilege escalation

published February 4, 2019

CVSS
—
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in local privilege escalation. Mounting via rename() could potentially lead to a file being placed elsewhereon the filesystem hierarchy (e.g. /etc/cron.d/) if the directory being cleaned up was on the same physical filesystem. Fixed versions include 1.6.13+nmu1+deb9u1 and 1.6.14.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00253 · 15.8th percentile
Published
2019-02-04T18:00Z
EPSS history
Timeline
  • 04 FEB 18:00Z
    Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in local privilege escalation
    cvelistv5