Bug 2376353 (CVE-2025-49809)

Summary: CVE-2025-49809 mtr: From CVEorg collector
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: adudiak, kshier, msekleta, omaciel, redhat-bugzilla, stcannon, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A possible privilege escalation flaw was found in the MTR networking tool. This issue occurs in rare cases when the package is configured to run with sudo rules instead of setuid and stems from its improper handling in the execution of a program specified by the MTR_PACKET environment variable.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2376431, 2376430    
Bug Blocks:    

Description OSIDB Bzimport 2025-07-04 13:01:13 UTC
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.

Comment 2 Michal Sekletar 2025-07-16 13:45:28 UTC
Note that we have closed all RHEL trackers for this as NOTABUG because RHEL versions of mtr are not affected to begin with and proposed fix doesn't apply to mtr in RHEL context (i.e. no custom mtr sudo rules are needed).