CVE-2016-1575

Published: 22 February 2016

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.

From the Ubuntu security team

halfdog discovered that OverlayFS in the Linux kernel incorrectly propagated security sensitive extended attributes, such as POSIX ACLs. A local unprivileged attacker could use this to gain privileges.

Priority

Medium

CVSS 3 base score: 7.8

Status

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

precise does not allow unprivileged user namespaces,
which is what lets an unprivileged user exploit this vulnerability;
however, the issue of copying up setuid attributes still exists in
the overlayfs codebase here, but it is a much lower priority to fix
(needs root/CAP_SYS_ADMIN to exploit).

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1575
• http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/
• https://usn.ubuntu.com/usn/usn-2910-1
• https://usn.ubuntu.com/usn/usn-2908-3
• https://usn.ubuntu.com/usn/usn-2908-1
• https://usn.ubuntu.com/usn/usn-2907-1
• https://usn.ubuntu.com/usn/usn-2909-1
• https://usn.ubuntu.com/usn/usn-2907-2
• https://usn.ubuntu.com/usn/usn-2908-2
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1534961