CVE-2018-10906 is a restriction bypass vulnerability in FUSE versions prior to 2.9.8 and 3.2.5, affecting products like Debian and Red Hat. This flaw allows non-root users to mount FUSE file systems with the 'allow_other' option, even when restricted by configuration, particularly when SELinux is active. Rated 7.8 HIGH (CVSSv3), it can lead to Denial of Service or other impacts by tricking other users into accessing malicious file systems. While not on the KEV catalog and with no Metasploit or Nuclei exploits, an ExploitDB entry (EDB-45106) exists, but there is minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
< 2.9.8CPE matchmatch criteria | cpe:2.3:a:fuse_project:fuse:*:*:*:*:*:*:*:* | ||
>= 3.0, < 3.2.5CPE matchmatch criteria | cpe:2.3:a:fuse_project:fuse:*:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2018-10906
Jun 11, 2024CVE-2018-10906
Aug 11, 2020fuse: bypass of the "user_allow_other" restriction when SELinux is active
Jul 24, 2018In fuse before versions 2.9.8 and 3.x before 3.2.5 fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system accessible by other users and trick them into accessing files on that file system possibly causing Denial of Service or other unspecified effects.
Jul 10, 2018