Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host
As a result, if an unprivileged local attacker creates, mounts, and deletes a deep directory structure whose total path length exceeds 1GB, and if the attacker open()s and read()s /proc/self/mountinfo, then
I am trying to understand how this works, because in my experience an unprivileged user cannot mount anything, unless there's a mountpoint in
/etc/fstab which has the
user attribute set.
Some people are talking about FUSE, but I believe even for FUSE, root access is needed to actually mount the filesystem just the filesystem code runs in user space, not kernel space. (I simply lacked the knowledge that FUSE has
I tried The POC exploit code and it does not work for me, so... What am I missing here?