A security flaw was identified in util-linux where restricted bind mounts read the source path from fstab without pinning (locking) that source path before performing the privileged mount operation. A local unprivileged user who can replace the authorized source directory or a writable ancestor directory can exploit this race condition to redirect the SUID mount(8) binary to bind an arbitrary host directory. If the fstab entry specifies X-mount.owner, X-mount.group, or X-mount.mode options, the root process will then apply ownership or permission changes to the redirected (attacker-controlled) inode. This effectively allows a local attacker to escalate privileges by manipulating file ownership or permissions on arbitrary system files. The vulnerability is a classic TOCTOU (Time-of-Check to Time-of-Use) issue in the mount utility. It affects systems where unprivileged users have writable access to mount source paths or their ancestors.
