Read the docs
TI-2008-03809 Aliases CVE-2008-3970GHSA-mvrg-287f-6v63

pam_mount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and…

Priority LOW 30CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

pam_mount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount.

Why it matters now

EPSS 0.0032 25th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:pam_mount:pam_mount:0.10:*:*:*:*:*:*:*0.10VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.11:*:*:*:*:*:*:*0.11VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.12.2:*:*:*:*:*:*:*0.12.2VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.13:*:*:*:*:*:*:*0.13VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.15:*:*:*:*:*:*:*0.15VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.16:*:*:*:*:*:*:*0.16VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.17:*:*:*:*:*:*:*0.17VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.18:*:*:*:*:*:*:*0.18VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.19:*:*:*:*:*:*:*0.19VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.20:*:*:*:*:*:*:*0.20VulnerablePam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.10:*:*:*:*:*:*:* Versions 0.10 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.11:*:*:*:*:*:*:* Versions 0.11 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.12.2:*:*:*:*:*:*:* Versions 0.12.2 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.13:*:*:*:*:*:*:* Versions 0.13 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.15:*:*:*:*:*:*:* Versions 0.15 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.16:*:*:*:*:*:*:* Versions 0.16 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.17:*:*:*:*:*:*:* Versions 0.17 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.18:*:*:*:*:*:*:* Versions 0.18 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.19:*:*:*:*:*:*:* Versions 0.19 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.20:*:*:*:*:*:*:* Versions 0.20 Vulnerable ·Pam Mount
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:pam_mount:pam_mount:0.21:*:*:*:*:*:*:*0.21VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.26:*:*:*:*:*:*:*0.26VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.27:*:*:*:*:*:*:*0.27VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.28:*:*:*:*:*:*:*0.28VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.29:*:*:*:*:*:*:*0.29VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.31:*:*:*:*:*:*:*0.31VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.32:*:*:*:*:*:*:*0.32VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.35:*:*:*:*:*:*:*0.35VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.35.1:*:*:*:*:*:*:*0.35.1VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.37:*:*:*:*:*:*:*0.37VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.38:*:*:*:*:*:*:*0.38VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.39:*:*:*:*:*:*:*0.39VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.40:*:*:*:*:*:*:*0.40VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.41:*:*:*:*:*:*:*0.41VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.43:*:*:*:*:*:*:*0.43VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.44:*:*:*:*:*:*:*0.44VulnerablePam Mount
cpe:2.3:a:pam_mount:pam_mount:0.45:*:*:*:*:*:*:*0.45VulnerablePam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.21:*:*:*:*:*:*:* Versions 0.21 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.26:*:*:*:*:*:*:* Versions 0.26 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.27:*:*:*:*:*:*:* Versions 0.27 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.28:*:*:*:*:*:*:* Versions 0.28 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.29:*:*:*:*:*:*:* Versions 0.29 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.31:*:*:*:*:*:*:* Versions 0.31 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.32:*:*:*:*:*:*:* Versions 0.32 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.35:*:*:*:*:*:*:* Versions 0.35 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.35.1:*:*:*:*:*:*:* Versions 0.35.1 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.37:*:*:*:*:*:*:* Versions 0.37 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.38:*:*:*:*:*:*:* Versions 0.38 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.39:*:*:*:*:*:*:* Versions 0.39 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.40:*:*:*:*:*:*:* Versions 0.40 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.41:*:*:*:*:*:*:* Versions 0.41 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.43:*:*:*:*:*:*:* Versions 0.43 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.44:*:*:*:*:*:*:* Versions 0.44 Vulnerable ·Pam Mount
  • cpe:2.3:a:pam_mount:pam_mount:0.45:*:*:*:*:*:*:* Versions 0.45 Vulnerable ·Pam Mount

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-3970
  2. 2026-10-03 Alias added: GHSA-mvrg-287f-6v63

References

Advisory 2

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences