CVE-2021-3996: fedoraproject fedora
Vulnerability summary
CVE-2021-3996 is a medium (CVSS 5.5) vulnerability in fedoraproject fedora. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 23-08-2022PublishedVulnerability first disclosed.
- 15-10-2024Last modifiedVulnerability information updated.
Description
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.64%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
+0.01 pp
From 0.63% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- util-linux≥ 2.34, < 2.37.3-r0
Debian1 product
- util-linux< 2.37.3-1
Fedoraproject1 product
- fedoraEOL35
Kernel1 product
- util-linux≥ 2.34, < 2.37.3
Ubuntu1 product
- util-linux< 2.34-0.1ubuntu9.3 | < 2.37.2-4ubuntu2
5 vendors · 5 products
References
16 links- mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.3-ReleaseNotesREPORTRelease NotesVendor Advisory
- github.com/util-linux/util-linux/commit/166e87368ae88bf31112a30e078cceae637f4cdbPatchThird Party Advisory
- security.gentoo.org/glsa/202401-08Vendor Advisory
