CVE-2016-2854

Published: 2 May 2016

The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.

From the Ubuntu Security Team

It was discovered that the aufs file system in the Linux kernel did not properly maintain POSIX ACL xattr data, when mounted with the non-default allow_userns option. A local attacker could possibly use this to gain elevated privileges.

Notes

requires aufs module inserted with allow_userns option,
which is not the default
in upstream aufs on 2016-02-19, marking kernel's that
imported aufs after that date as not-affected

Priority

Low

CVSS 3 base score: 7.8

Status