A flaw in the BusyBox mount utility allows a non-root user to override the security options defined in /etc/fstab by supplying clearing-mask options on the command line. These clearing options are merged with the fstab options and, when re-parsed, can negate the nosuid, nodev, and noexec protections that an administrator expects to enforce, potentially allowing privilege escalation or execution of arbitrary binaries on protected filesystems.

Red Hat Hardened Images contain the vulnerable BusyBox mount binary that is installed with setuid root, and the vulnerability affects the default configuration of that product. No specific version information is listed, but all deployments using the default busybox setuid mount utility are impacted.

The vulnerability carries a CVSS score of 5.5, indicating moderate severity. The EPSS score is not available at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a non-root account with the ability to execute the BusyBox mount binary; the attacker can supply clearing-mask options on the command line to strip the nosuid, nodev, and noexec flags enforced by /etc/fstab, effectively bypassing the intended security controls.