CVE-2015-2925

The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."

CVSS v2.0

6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C

EPSS

1.25% chance of exploitation in the next 30 days, 67th percentile

Published

2015-11-16

Updated

2024-08-06

Proof-of-concept exploits (1)

• Kagami/docker_cve-2015-292511★ · 2015-06-30

References

• CVE Record
• NVD entry

Related

• CVE-2015-2900
• CVE-2015-2993
• CVE-2015-2898
• CVE-2015-2994
• CVE-2015-2878
• CVE-2015-2995