CME-503
nosuid on Non-Root Partitions
Description
Mounts partitions like /tmp, /var, /home with nosuid, preventing SUID/SGID binaries from taking effect, blocking a privilege escalation vector.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Privileges Required (PR) | L → H | Cannot deploy SUID binaries to escalate privileges from these partitions |
CWE Relationships
Verification
Check nosuid on non-root partitions
$ mount | grep '/tmp' | grep nosuid
# Expected: nosuid
# Expected: nosuid
Platform: linux
$ mount | grep '/home' | grep nosuid
# Expected: nosuid
# Expected: nosuid
Platform: linux