7.8high
CVE-2016-28531 exploit
The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privilege…
Published 10 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 60%
Public exploits
1
Exploit-DB
Summary
The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an aufs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.
Exploit prediction (EPSS)
0.91% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.
Exploits and detections
- EDB-41761 AUFS (Ubuntu 15.10) - 'allow_userns' Fuse/Xattr User Namespaces Privilege Escalation · local · 2016-02-19
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-269 Improper Privilege Management
- Technology feeds
- Linux kernel (RSS, critical only)
References
- securityfocus.com /bid/96839 · vdb-entry, x_refsource_BID, x_transferred
- halfdog.net /Security/2016/AufsPrivilegeEscalationInUserNamespaces/ · x_refsource_MISC, x_transferred
- openwall.com /lists/oss-security/2016/02/24/9 · mailing-list, x_refsource_MLIST, x_transferred
- sourceforge.net /p/aufs/mailman/message/34864744/ · mailing-list, x_refsource_MLIST, x_transferred
- openwall.com /lists/oss-security/2021/10/18/1 · mailing-list, x_refsource_MLIST, x_transferred
Sources
- CVE List: CVE-2016-2853
- NVD: CVE-2016-2853
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.