CVE-2013-0157: Infoleak
(a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates different error messages depending on whether the directory exists.
Other sources
This was originally reported by Jann Horn (jannhorn):
mount discloses information about folders not accessible for a user:
$ ls -ld /root/.ssh ls: cannot access /root/.ssh: Permission denied $ ls -ld /root/.foo ls: cannot access /root/.foo: Permission denied
First variant:
$ mount --guess-fstype /root/.ssh/../../dev/sda1 ext4 $ mount --guess-fstype /root/.foo/../../dev/sda1 unknown
Second one:
$ mount /root/.ssh/../../dev/cdrom mount: no medium found on /dev/sr0 $ mount /root/.foo/../../dev/cdrom mount: can't find /root/.foo/../../dev/cdrom in /etc/fstab or /etc/mtab
These issues were, as far as I can see, fixed in the following upstream commits: - 0377ef91270d06592a0d4dd009c29e7b1ff9c9b8 - 33c5fd0c5a774458470c86f9d318d8c48a9c9ccb - 5ebbc3865d1e53ef42e5f121c41faab23dd59075 - cc8cc8f32c863f3ae6a8a88e97b47bcd6a21825f
External references: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=697464
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0157?
CVE-2013-0157 has a low severity rating as it allows local users to enumerate restricted directories but does not lead to direct code execution.
How do I fix CVE-2013-0157?
To fix CVE-2013-0157, ensure that you update util-linux to a version that addresses this vulnerability.
Which versions of util-linux are affected by CVE-2013-0157?
CVE-2013-0157 affects util-linux versions 2.14.1 and 2.17.2 specifically, among possibly other versions.
What methods do local users use to exploit CVE-2013-0157?
Local users can exploit CVE-2013-0157 by using the --guess-fstype option or by attempting to mount a non-existent device.
Does CVE-2013-0157 require remote access to exploit?
No, CVE-2013-0157 does not require remote access as it can be exploited locally.