CVE-2016-2853
AUFS (Ubuntu 15.10) - 'allow_userns' Fuse/Xattr User Namespaces Privilege Escalation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
4Exploited in Wild
-Decision
Descriptions
The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an aufs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.
El módulo aufs para el kernel de Linux 3.x y 4.x no restringe correctamente el espacio de nombres de montaje, lo que permite a usuarios locales obtener privilegos montando un sistema de archivos aufs sobre un sistema de archivos FUSE y luego ejecutando un programa setuid manipulado.
Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges. It was discovered that the aufs file system in the Linux kernel did not properly restrict mount namespaces, when mounted with the non-default allow_userns option set. A local attacker could use this to gain administrative privileges.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-02-19 First Exploit
- 2016-03-06 CVE Reserved
- 2016-05-02 CVE Published
- 2024-08-05 CVE Updated
- 2025-05-14 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-269: Improper Privilege Management
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2021/10/18/1 | Mailing List |
|
| http://www.securityfocus.com/bid/96839 | Broken Link | |
| https://sourceforge.net/p/aufs/mailman/message/34864744 | Mailing List |
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/141914 | 2017-04-01 | |
| https://www.exploit-db.com/exploits/41761 | 2016-02-19 | |
| http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces | 2024-08-05 | |
| http://www.openwall.com/lists/oss-security/2016/02/24/9 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.0.0 <= 3.19.8 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.0.0 <= 3.19.8" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.0.0 <= 4.20.15 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.0.0 <= 4.20.15" | - |
Affected
| ||||||