CVE-2016-1575

Published: 22 February 2016

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.

From the Ubuntu security team

halfdog discovered that OverlayFS in the Linux kernel incorrectly propagated security sensitive extended attributes, such as POSIX ACLs. A local unprivileged attacker could use this to gain privileges.

Priority

Medium

CVSS 3 base score: 7.8

Status

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

precise does not allow unprivileged user namespaces,
which is what lets an unprivileged user exploit this vulnerability;
however, the issue of copying up setuid attributes still exists in
the overlayfs codebase here, but it is a much lower priority to fix
(needs root/CAP_SYS_ADMIN to exploit).

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1575
• http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/
• https://ubuntu.com/security/notices/USN-2910-1
• https://ubuntu.com/security/notices/USN-2908-3
• https://ubuntu.com/security/notices/USN-2908-1
• https://ubuntu.com/security/notices/USN-2907-1
• https://ubuntu.com/security/notices/USN-2909-1
• https://ubuntu.com/security/notices/USN-2907-2
• https://ubuntu.com/security/notices/USN-2908-2
• https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/trusty/commit/?id=4dc7ebf4284cdc90e8f3cd617ed247aade2ca39f
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1534961