Description
ecryptfs-setup-swap in eCryptfs before 111 does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning and certain versions of systemd, which allows local users to obtain sensitive information via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ecryptfs-utils | 111-1 | — |
| Debian 13 | ecryptfs-utils | 111-1 | — |
| Debian 12 | ecryptfs-utils | 111-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | ecryptfs-utils | 103-8.3.1 | SUSE-SU-2018:0336-1 |
| SLES 12 SP2 | ecryptfs-utils | 103-8.3.1 | SUSE-SU-2018:0336-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP3 | ecryptfs-utils | 103-8.3.1 | SUSE-SU-2018:0336-1 |
| SLES for SAP 12 SP2 | ecryptfs-utils | 103-8.3.1 | SUSE-SU-2018:0336-1 |
Advisories 1
- SUSE-SU-2018:0336-1 Security update for ecryptfs-utils SUSE / openSUSE Security Updates · May 2, 2025
References
- [oss-security] 20160714 Re: CVE Requests: Information exposure caused by ecryptfs-setup-swap failures mailing-list
- [oss-security] 20160713 CVE Requests: Information exposure caused by ecryptfs-setup-swap failures mailing-list
- https://bazaar.launchpad.net/~ecryptfs/ecryptfs/trunk/revision/857
- https://bugs.launchpad.net/ubuntu/+source/ecryptfs-utils/+bug/1447282
- USN-3032-1 vendor-advisory