Summary:
--------
pmount is a wrapper around the standard mount program which permits
normal users to mount removable devices without a matching /etc/fstab entry.
Due to a missing input validation check local users could mount devices
to arbitrary destinations and thus taking over the targeted system
completely.

Prerequisites:
--------------
Local user access to the target
Pmount 0.9.23 or older to be installed (any version at time of writing
this report)
/media directory to be empty

Description:
------------
pmount is a wrapper around the standard mount program which permits
normal users to mount removable devices without a matching /etc/fstab entry.

The default build of the pmount command mounts the specified device
under /media/label where label is subdirectory of /media. Label can be
specified as a command line parameter of pmount, and it is the basename
of the device to be mounted if omitted.
The pmount binary has setuid flag and owned by root.

The pmount command as of version 0.9.23 misses a validation check of the
label argument: single dot (.) as label is accepted by pmount.

Pmount verifies whether the destination directory  (normally
/media/label) is empty and refuses to mount if it is not.
Since the /media directory is usually populated with floppy and cdrom
directories in popular Linux distributions, the exploitability of this
vulnerability is probably low.

If the media dir is empty one can specify a simple dot as label, the
device is then mounted to /media then.
This is possible because the make_mountpoint_name() function in pmount.c
does not prevent this case.

Once this mount succeeded, the contents of the /media directory is
controlled by the attacker. Breaking out of /media restriction is then
possible by further invocation of pmount.
Although pmount verifies whether the specified destination path is empty
or not, the execv call with the mount command is not executed atomically
with the emptyness check. This is a Time of check time of use (TOCTOU)
problem, and as contents of the /media directory is already controlled
by the attacker, with appropriate timing
this can be exploited to mount to arbitrary destinations. This is
possible for example by replacing the empty directory of the label to a
symbolic link.

Status:
-------
The vulnerability is not addressed at the time of publishing this
disclosure.

Additional information:
-----------------------
Discovered by: Imre Rad
Reported on: 2016-03-21
Disclosure: 2016-07-13