Medium severity5.5NVD Advisory· Published Aug 23, 2022· Updated Jun 17, 2026
CVE-2021-3996
CVE-2021-3996
Description
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
24- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- util-linux/libmountdescription
- osv-coords20 versionspkg:rpm/opensuse/libeconf&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/python3-libmount&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/shadow&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/util-linux&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/util-linux&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/util-linux-systemd&distro=openSUSE%20Leap%2015.3pkg:rpm/suse/libeconf&distro=SUSE%20Linux%20Enterprise%20Micro%205.1pkg:rpm/suse/libeconf&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/libeconf&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/libeconf&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Transactional%20Server%2015%20SP3pkg:rpm/suse/shadow&distro=SUSE%20Linux%20Enterprise%20Micro%205.1pkg:rpm/suse/shadow&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/shadow&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/util-linux&distro=SUSE%20Linux%20Enterprise%20Micro%205.1pkg:rpm/suse/util-linux&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/util-linux&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/util-linux-systemd&distro=SUSE%20Linux%20Enterprise%20Micro%205.1pkg:rpm/suse/util-linux-systemd&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/util-linux-systemd&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/util-linux-systemd&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP3
< 0.4.4+git20220104.962774f-150300.3.6.2+ 19 more
- (no CPE)range: < 0.4.4+git20220104.962774f-150300.3.6.2
- (no CPE)range: < 2.36.2-150300.4.14.2
- (no CPE)range: < 4.8.1-150300.4.3.8
- (no CPE)range: < 2.36.2-150300.4.14.3
- (no CPE)range: < 2.37.3-1.1
- (no CPE)range: < 2.36.2-150300.4.14.2
- (no CPE)range: < 0.4.4+git20220104.962774f-150300.3.6.2
- (no CPE)range: < 0.4.4+git20220104.962774f-150300.3.6.2
- (no CPE)range: < 0.4.4+git20220104.962774f-150300.3.6.2
- (no CPE)range: < 0.4.4+git20220104.962774f-150300.3.6.2
- (no CPE)range: < 4.8.1-150300.4.3.8
- (no CPE)range: < 4.8.1-150300.4.3.8
- (no CPE)range: < 4.8.1-150300.4.3.8
- (no CPE)range: < 2.36.2-150300.4.14.3
- (no CPE)range: < 2.36.2-150300.4.14.3
- (no CPE)range: < 2.36.2-150300.4.14.3
- (no CPE)range: < 2.36.2-150300.4.14.2
- (no CPE)range: < 2.36.2-150300.4.14.2
- (no CPE)range: < 2.36.2-150300.4.14.2
- (no CPE)range: < 2.36.2-150300.4.14.2
Patches
Vulnerability mechanics
References
10- bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchThird Party Advisory
- github.com/util-linux/util-linux/commit/166e87368ae88bf31112a30e078cceae637f4cdbnvdPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2022/01/24/2nvdExploitMailing ListPatchThird Party Advisory
- packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.htmlnvdThird Party Advisory
- seclists.org/fulldisclosure/2022/Dec/4nvdMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2022/11/30/2nvdMailing ListThird Party Advisory
- access.redhat.com/security/cve/CVE-2021-3996nvdIssue TrackingThird Party Advisory
- mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.3-ReleaseNotesnvdRelease NotesVendor Advisory
- security.netapp.com/advisory/ntap-20221209-0002/nvdBroken LinkThird Party Advisory
- security.gentoo.org/glsa/202401-08nvd
News mentions
0No linked articles in our index yet.