## https://sploitus.com/exploit?id=DDE742FD-8567-5DEA-8F1A-1C8BC6E5630C
# CVE-2026-53613 PoC
TOCTOU vulnerability in mount(8) allowing local privilege escalation to root.
## Vulnerable Versions
- util-linux 2.41.0 through 2.41.4
- util-linux 2.42.0 through 2.42.1
## Exploits
| File | Method | Target |
|------|--------|--------|
| exploit_shell.sh | SSH key extraction | /root |
| exploit_direct_shell.sh | Direct shell | /bin |
## Quick Start
```bash
# Method 1: Extract SSH key and SSH as root
bash exploit_shell.sh 1000
# Method 2: Mount /bin and spawn shell
bash exploit_direct_shell.sh 2000
```
Increase iterations for higher success rate on slow systems.
## How It Works
1. TOCTOU race window in mount(8) path validation
2. Replace directory with symlink before mount validates
3. Kernel follows symlink to sensitive location (/root or /bin)
4. Access mounted filesystem or execute privileged code
5. Privilege escalation achieved
## Attack Chain
```
Unprivileged user
↓
mount(8) SUID binary
↓
Win TOCTOU race
↓
Mount /root filesystem
↓
Extract SSH private key
↓
SSH as root
↓
ROOT SHELL
```
## Requirements
- Linux system with vulnerable util-linux
- 256MB free disk space
- Write access to /tmp
- No sudoers configuration needed (mount(8) is SUID)
- SSH running (for Method 1, optional for Method 2)
## Technical Details
The vulnerability exists because:
1. mount(8) validates the target path using stat()
2. Time passes (race window)
3. Attacker replaces directory with symlink to /root or /bin
4. mount(8) calls mount() syscall with original path string
5. Kernel follows symlink, mounts sensitive directory at attacker location
6. No re-validation between validation and syscall = TOCTOU
## Success Indicators
- Race won message appears
- Mounted filesystem accessible
- Shell spawned or SSH login succeeds
## Patched Versions
- util-linux 2.41.5+
- util-linux 2.42.2+
Patch uses fd-based mount operations to prevent symlink TOCTOU.
## Disclaimer
For educational and authorized security testing only.
- ✅ Authorized penetration testing
- ✅ Vulnerability research
- ✅ Defensive assessment
- ❌ Unauthorized access
- ❌ Malicious exploitation
Obtain proper authorization before testing on systems you don't own.