CVE-2016-1575
HIGH 7.8EPSS 0.9%
The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.
- CVSS v3.1 NVD
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 7.2 HIGH
AV:L/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 0.92% chance of exploitation in the next 30 days, 60th percentile
- Published
- 2016-05-02
- Updated
- 2024-08-05
Proof-of-concept exploits (1)
ExploitDB entries (1)
Security advisories
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0…
- http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1575.html
- http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation
- http://www.openwall.com/lists/oss-security/2016/02/24/7
- http://www.openwall.com/lists/oss-security/2021/10/18/1
- https://launchpad.net/bugs/1534961