CVE-2021-3995: fedoraproject fedora
Vulnerability summary
CVE-2021-3995 is a medium (CVSS 5.5) vulnerability in fedoraproject fedora. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.5% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 23-08-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.64%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
+0.01 pp
From 0.63% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- util-linux≥ 2.34, < 2.37.3-r0
Debian1 product
- util-linux< 2.37.3-1
Fedoraproject1 product
- fedoraEOL35
Kernel1 product
- util-linux≥ 2.34, < 2.37.3
Ubuntu1 product
- util-linux< 2.34-0.1ubuntu9.3 | < 2.37.2-4ubuntu2
5 vendors · 5 products
References
15 links- mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.3-ReleaseNotesREPORTRelease NotesVendor Advisory
- github.com/util-linux/util-linux/commit/57202f5713afa2af20ffbb6ab5331481d0396f8dPatchThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2024631https://access.redhat.com/security/cve/CVE-2021-3995Broken LinkIssue Tracking
- packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.htmlThird Party AdvisoryVDB Entry
- security.netapp.com/advisory/ntap-20221209-0002/Third Party Advisory
- security.gentoo.org/glsa/202401-08Vendor Advisory
