CVE-2026-53613 PoC

TOCTOU vulnerability in mount(8) allowing local privilege escalation to root.

Vulnerable Versions

• util-linux 2.41.0 through 2.41.4
• util-linux 2.42.0 through 2.42.1

Exploits

Quick Start

# Method 1: Extract SSH key and SSH as root
bash exploit_shell.sh 1000

# Method 2: Mount /bin and spawn shell
bash exploit_direct_shell.sh 2000

Increase iterations for higher success rate on slow systems.

How It Works

1. TOCTOU race window in mount(8) path validation
2. Replace directory with symlink before mount validates
3. Kernel follows symlink to sensitive location (/root or /bin)
4. Access mounted filesystem or execute privileged code
5. Privilege escalation achieved

Attack Chain

Unprivileged user
  ↓
mount(8) SUID binary
  ↓
Win TOCTOU race
  ↓
Mount /root filesystem
  ↓
Extract SSH private key
  ↓
SSH as root
  ↓
ROOT SHELL

Requirements

• Linux system with vulnerable util-linux
• 256MB free disk space
• Write access to /tmp
• No sudoers configuration needed (mount(8) is SUID)
• SSH running (for Method 1, optional for Method 2)

Technical Details

The vulnerability exists because:

1. mount(8) validates the target path using stat()
2. Time passes (race window)
3. Attacker replaces directory with symlink to /root or /bin
4. mount(8) calls mount() syscall with original path string
5. Kernel follows symlink, mounts sensitive directory at attacker location
6. No re-validation between validation and syscall = TOCTOU

Success Indicators

• Race won message appears
• Mounted filesystem accessible
• Shell spawned or SSH login succeeds

Patched Versions

• util-linux 2.41.5+
• util-linux 2.42.2+

Patch uses fd-based mount operations to prevent symlink TOCTOU.

Disclaimer

For educational and authorized security testing only.

• ✅ Authorized penetration testing
• ✅ Vulnerability research
• ✅ Defensive assessment
• ❌ Unauthorized access
• ❌ Malicious exploitation

Obtain proper authorization before testing on systems you don't own.