CVE-2019-3461: Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in local privilege escalation. Mounting via…

PriorityP431high7CVSS 3.0

AVLACHPRLUINSUCHIHAH

EPSS

0.25%

16.7th percentile

Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in local privilege escalation. Mounting via rename() could potentially lead to a file being placed elsewhereon the filesystem hierarchy (e.g. /etc/cron.d/) if the directory being cleaned up was on the same physical filesystem. Fixed versions include 1.6.13+nmu1+deb9u1 and 1.6.14.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	debian_linux	—	—
debian	tmpreaper	< tmpreaper 1.6.14 (bookworm)	tmpreaper 1.6.14 (bookworm)
debian	tmpreaper	—	—
debian	tmpreaper	>= 0 < 1.6.14	1.6.14
debian	tmpreaper	>= 0 < 1.6.14	1.6.14
debian	tmpreaper	>= 0 < 1.6.14	1.6.14
debian	tmpreaper	>= 0 < 1.6.14	1.6.14
debian_gnu	linux_tmpreaper	—	—

CVSS provenance

nvdv3.07.0HIGHCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P

osv7.0HIGH

vendor_debian7.0HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.