Util-Linux Umount Filesystem NULL Pointer Dereference Vulnerability

BID:22850

Info

Util-Linux Umount Filesystem NULL Pointer Dereference Vulnerability

Bugtraq ID: 22850
Class: Design Error
CVE: CVE-2007-0822
Remote: No
Local: Yes
Published: Mar 07 2007 12:00AM
Updated: May 23 2007 09:37PM
Credit: Carlos Barros discovered this vulnerability.
Vulnerable: util-linux util-linux 2.12 r
util-linux util-linux 2.12 q
Slackware Linux 10.2
Pardus Linux 2007.1
Mandriva Linux Mandrake 2006.0 x86_64
Mandriva Linux Mandrake 2006.0
Mandriva Linux Mandrake 2007.0 x86_64
Mandriva Linux Mandrake 2007.0
MandrakeSoft Corporate Server 4.0 x86_64
MandrakeSoft Corporate Server 4.0
Linux kernel 2.6.15
Not Vulnerable:

Discussion

Util-Linux Umount Filesystem NULL Pointer Dereference Vulnerability

Util-Linux 'umount' is prone to a NULL-pointer dereference vulnerability.

A local attacker can exploit this issue to crash the affected application, denying service to legitimate users. The attacker may also be able to obtain sensitive information, including the contents of core files.

Util-Linux Umount implemented on Linux kernel 2.6.15 is reported vulnerable to this issue.

Exploit / POC

Util-Linux Umount Filesystem NULL Pointer Dereference Vulnerability

An attacker can exploit this issue using standard 'mount' and 'umount' commands.

Solution / Fix

Util-Linux Umount Filesystem NULL Pointer Dereference Vulnerability

Solution:
Specific vendors have released fixes for this issue. Please see the vendor references for details.


util-linux util-linux 2.12 q

util-linux util-linux 2.12 r

References

Util-Linux Umount Filesystem NULL Pointer Dereference Vulnerability

References:
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report