CVE-2013-0157

(a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates different error messages depending on whether the directory exists.

Published: 2014-01-21 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2013-0157 is rated Low Risk (18.9/100): CVSS Low severity, with low exploitation likelihood (EPSS 0.38%). Low composite risk—no urgent action required; patch on your normal maintenance cycle and revisit priority if CVSS or EPSS increases.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2013-0157

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.06% 0.38% +0.32%
2 2025-03-17 0.04% 0.06% +0.01%
3 2023-03-07 — 0.04% —

Full EPSS history (6 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2013-0157

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
2.1 2.0 LOW
AV:L/AC:L/Au:N/C:P/I:N/A:N Click to expand
Access vector (AV:L)
Requires local access to the target system.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:N)
No availability impact.
 3.9 2.9 [email protected]

Weakness enumeration for CVE-2013-0157

OS Trackers for CVE-2013-0157

vendor priority summary link
debian low CVE-2013-0157 low priority: Debian including 1 source packages (util-linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2013-0157
gentoo normal CVE-2013-0157: 1 GLSA(s) (201405-15), 1 atom(s) (sys-apps/util-linux); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2013-0157
redhat low — https://access.redhat.com/security/cve/CVE-2013-0157
suse low CVE-2013-0157 severity low: SUSE including 195 source package names (lastlog2-2.40.1-slfo.1.1_1.2, lastlog2-2.41.1-160000.2.2, …), 305 product×package rows across 33 product lines (SUSE Linux Enterprise Desktop 12, SUSE Linux Enterprise Desktop 12 SP1, … (33 product lines)): Fixed 305. https://www.suse.com/security/cve/CVE-2013-0157/
ubuntu low CVE-2013-0157 low priority: Ubuntu including 1 source packages (util-linux), 32 status rows across 32 suites (artful, bionic, cosmic, disco, eoan, focal, groovy, hardy, hirsute, impish, jammy, kinetic, lucid, lunar, mantic, noble, oneiric, oracular, plucky, precise, quantal, questing, raring, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): not-affected 23, ignored 7, needed 1, released 1. https://ubuntu.com/security/CVE-2013-0157

Affected software / configurations for CVE-2013-0157

Vendor Product Version Raw CPE
kernel util-linux 2.14.1 cpe:2.3:a:kernel:util-linux:2.14.1:*:*:*:*:*:*:*
kernel util-linux 2.17.2 cpe:2.3:a:kernel:util-linux:2.17.2:*:*:*:*:*:*:*

References for CVE-2013-0157

cvelogic Threat Intelligence