QwikSec

Security Database

CVE

CWE

Training

CVE-2016-1576

Published: May 2, 2016

Modified: Aug 5, 2024

PUBLISHED

Description

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://launchpadlibrarian.net/235300093/0005-overlayfs-Be-more-careful-about-copying-up-sxid-file.patch

x_refsource_MISC

https://launchpadlibrarian.net/235300225/0006-overlayfs-Propogate-nosuid-from-lower-and-upper-moun.patch

x_refsource_MISC

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79360

x_refsource_MISC

https://bugs.launchpad.net/bugs/1535150

x_refsource_CONFIRM

[oss-security] 20160224 Overlayfs over Fuse Privilege Escalation in USERNS

mailing-list

x_refsource_MLIST

http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1576.html

x_refsource_CONFIRM

http://www.halfdog.net/Security/2016/OverlayfsOverFusePrivilegeEscalation/

x_refsource_MISC

[oss-security] 20211018 Re: CVE-2021-3847: OverlayFS - Potential Privilege Escalation using overlays copy_up

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.