Description
(a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates different error messages depending on whether the directory exists.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | util-linux | 2.20.1-5.5 | — |
| Debian 13 | util-linux | 2.20.1-5.5 | — |
| Debian 12 | util-linux | 2.20.1-5.5 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | util-linux | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | uuidd +5 | 2.17.2-12.9.el6 | RHSA-2013:0517 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | util-linux | 2.28.2-2.1 | openSUSE-SU-2024:10279-1 |
Advisories 2
- RHSA-2013:0517 Red Hat Security Advisory: util-linux-ng security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10279-1 libblkid-devel-2.28.2-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://bugs.debian.org/697464
- 88953 vdb-entry
- RHSA-2013:0517 vendor-advisory
- [oss-security] 20130106 Re: CVE request: mount/umount leak information about existence of folders mailing-list
- MDVSA-2013:154 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=892330