CVE-2016-1576

Published: 22 February 2016

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.

From the Ubuntu Security Team

halfdog discovered that OverlayFS, when mounting on top of a FUSE mount, incorrectly propagated file attributes, including setuid. A local unprivileged attacker could use this to gain privileges.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

precise does not allow unprivileged user namespaces, which is
what lets an unprivileged user exploit this vulnerability; however,
the issue of copying up setuid attributes still exists in the
overlayfs codebase here, but it is a much lower priority to fix
(needs root/CAP_SYS_ADMIN to exploit).

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1576
• http://www.halfdog.net/Security/2016/OverlayfsOverFusePrivilegeEscalation/
• https://ubuntu.com/security/notices/USN-2910-1
• https://ubuntu.com/security/notices/USN-2908-3
• https://ubuntu.com/security/notices/USN-2908-1
• https://ubuntu.com/security/notices/USN-2907-1
• https://ubuntu.com/security/notices/USN-2909-1
• https://ubuntu.com/security/notices/USN-2907-2
• https://ubuntu.com/security/notices/USN-2908-2
• https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/trusty/commit/?id=ce550fb847b34553e63ee95386de59a1096fbfc4
• https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/trusty/commit/?id=d77014a9527a4544797b9f1f2026b8e9fe032355
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1535150