It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-099 advisory.

    A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

    A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

    A flaw was found in the Linux kernel's util-linux chfn and chsh utilities when compiled with Readline     support. The Readline library uses an INPUTRC environment variable to get a path to the library config     file. When the library cannot parse the specified file, it prints an error message containing data from     the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege     escalation. (CVE-2022-0563)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202401-08 (util-linux: Multiple Vulnerabilities)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker     were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file.
    NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments     (CVE-2021-37600)

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an 'INPUTRC' environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an 'INPUTRC' environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4.(CVE-2022-0563)

Tenable has extracted the preceding description block directly from the EulerOS util-linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of util-linux installed on the remote host is prior to 2.37.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-218 advisory.

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the util-linux-2.37.4-3.el9 build changelog.

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the util package has been released.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
164772	Amazon Linux 2022 : libblkid, libblkid-devel, libfdisk (ALAS2022-2022-099)	Nessus	Amazon Linux Local Security Checks	2022/9/6	2024/12/11	medium
187668	GLSA-202401-08 : util-linux: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/1/7	2024/1/7	medium
161862	EulerOS 2.0 SP10 : util-linux (EulerOS-SA-2022-1815)	Nessus	Huawei Local Security Checks	2022/6/6	2022/6/6	medium
198170	EulerOS 2.0 SP12 : util-linux (EulerOS-SA-2024-1757)	Nessus	Huawei Local Security Checks	2024/5/30	2024/5/30	medium
256393	Linux Distros Unpatched Vulnerability : CVE-2022-0563	Nessus	Misc.	2025/8/27	2026/9/2	medium
168590	Amazon Linux 2022 : util-linux (ALAS2022-2022-218)	Nessus	Amazon Linux Local Security Checks	2022/12/10	2024/12/11	medium
191356	CentOS 9 : util-linux-2.37.4-3.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	medium
203415	Photon OS 4.0: Util PHSA-2022-4.0-0182	Nessus	PhotonOS Local Security Checks	2024/7/23	2026/11/2	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium