Linux FUSE Vulnerability Gives Attackers Access to Root Privileges

The subsystem of FUSE (Filesystem in Userspace), in Linux contains a vulnerability that allows attackers to gain root privileges through creating an oversized directory. By making an oversized directory, Linux converts the data into a single cache page without checking if the entry is bigger then a single page. The remaining overflow can change executable code into payloads that allow an attacker to bypass authentication and gain root access. Linux has released a patch for preventing overfilled directories from being cached, but restricting FUSE and underprivileged namespaces can assist in mitigating this vulnerability risk.