CVE-2016-1575

Published: 22 February 2016

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.

From the Ubuntu security team

halfdog discovered that OverlayFS in the Linux kernel incorrectly propagated security sensitive extended attributes, such as POSIX ACLs. A local unprivileged attacker could use this to gain privileges.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

precise does not allow unprivileged user namespaces,
which is what lets an unprivileged user exploit this vulnerability;
however, the issue of copying up setuid attributes still exists in
the overlayfs codebase here, but it is a much lower priority to fix
(needs root/CAP_SYS_ADMIN to exploit).

Priority

Medium

CVSS 3 base score: 7.8

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1575
• http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/
• https://ubuntu.com/security/notices/USN-2910-1
• https://ubuntu.com/security/notices/USN-2908-3
• https://ubuntu.com/security/notices/USN-2908-1
• https://ubuntu.com/security/notices/USN-2907-1
• https://ubuntu.com/security/notices/USN-2909-1
• https://ubuntu.com/security/notices/USN-2907-2
• https://ubuntu.com/security/notices/USN-2908-2
• https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/trusty/commit/?id=4dc7ebf4284cdc90e8f3cd617ed247aade2ca39f
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1534961