vulnwire
7.8high

CVE-2016-15761 exploit

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.1%
percentile 67%
Public exploits
1
Exploit-DB

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.

Exploit prediction (EPSS)

1.13% probability of exploitation in the next 30 days, higher than 67% of all scored CVEs.

Exploits and detections

  • EDB-41763 Ubuntu 15.10 - 'USERNS ' Overlayfs Over Fuse Privilege Escalation · local · 2016-11-22

CVSS scores

Assigned byVersionScoreVector
NVD3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Technology feeds
Linux kernel (RSS, critical only)

References

  • launchpadlibrarian.net /235300093/0005-overlayfs-Be-more-careful-about-copying-up-sxid-file.patch · x_refsource_MISC, x_transferred
  • launchpadlibrarian.net /235300225/0006-overlayfs-Propogate-nosuid-from-lower-and-upper-moun.patch · x_refsource_MISC, x_transferred
  • git.kernel.org /cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79 · x_refsource_MISC, x_transferred
  • bugs.launchpad.net /bugs/1535150 · x_refsource_CONFIRM, x_transferred
  • openwall.com /lists/oss-security/2016/02/24/8 · mailing-list, x_refsource_MLIST, x_transferred
  • people.canonical.com /~ubuntu-security/cve/2016/CVE-2016-1576.html · x_refsource_CONFIRM, x_transferred
  • halfdog.net /Security/2016/OverlayfsOverFusePrivilegeEscalation/ · x_refsource_MISC, x_transferred
  • openwall.com /lists/oss-security/2021/10/18/1 · mailing-list, x_refsource_MLIST, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.