Summary: -------- pmount is a wrapper around the standard mount program which permits normal users to mount removable devices without a matching /etc/fstab entry. Due to a missing input validation check local users could mount devices to arbitrary destinations and thus taking over the targeted system completely. Prerequisites: -------------- Local user access to the target Pmount 0.9.23 or older to be installed (any version at time of writing this report) /media directory to be empty Description: ------------ pmount is a wrapper around the standard mount program which permits normal users to mount removable devices without a matching /etc/fstab entry. The default build of the pmount command mounts the specified device under /media/label where label is subdirectory of /media. Label can be specified as a command line parameter of pmount, and it is the basename of the device to be mounted if omitted. The pmount binary has setuid flag and owned by root. The pmount command as of version 0.9.23 misses a validation check of the label argument: single dot (.) as label is accepted by pmount. Pmount verifies whether the destination directory (normally /media/label) is empty and refuses to mount if it is not. Since the /media directory is usually populated with floppy and cdrom directories in popular Linux distributions, the exploitability of this vulnerability is probably low. If the media dir is empty one can specify a simple dot as label, the device is then mounted to /media then. This is possible because the make_mountpoint_name() function in pmount.c does not prevent this case. Once this mount succeeded, the contents of the /media directory is controlled by the attacker. Breaking out of /media restriction is then possible by further invocation of pmount. Although pmount verifies whether the specified destination path is empty or not, the execv call with the mount command is not executed atomically with the emptyness check. This is a Time of check time of use (TOCTOU) problem, and as contents of the /media directory is already controlled by the attacker, with appropriate timing this can be exploited to mount to arbitrary destinations. This is possible for example by replacing the empty directory of the label to a symbolic link. Status: ------- The vulnerability is not addressed at the time of publishing this disclosure. Additional information: ----------------------- Discovered by: Imre Rad Reported on: 2016-03-21 Disclosure: 2016-07-13