CVE-2016-2854
AUFS (Ubuntu 15.10) - 'allow_userns' Fuse/Xattr User Namespaces Privilege Escalation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
4Exploited in Wild
-Decision
Descriptions
The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.
El módulo aufs para el kernel de Linux 3.x y 4.x no mantiene correctamente datos POSIX ACL xattr, lo que permite a usuarios locales obtener privilegos aprovechando un directorio con permiso de escritura de grupo setgid.
Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges. It was discovered that the aufs file system in the Linux kernel did not properly restrict mount namespaces, when mounted with the non-default allow_userns option set. A local attacker could use this to gain administrative privileges.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-02-19 First Exploit
- 2016-03-06 CVE Reserved
- 2016-05-02 CVE Published
- 2024-08-05 CVE Updated
- 2025-05-14 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-269: Improper Privilege Management
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/96838 | Third Party Advisory | |
| https://sourceforge.net/p/aufs/mailman/message/34864744 | Mailing List |
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/141914 | 2017-04-01 | |
| https://www.exploit-db.com/exploits/41761 | 2016-02-19 | |
| http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces | 2024-08-05 | |
| http://www.openwall.com/lists/oss-security/2016/02/24/9 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.0.0 <= 3.19.8 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.0.0 <= 3.19.8" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.0.0 <= 4.20.15 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.0.0 <= 4.20.15" | - |
Affected
| ||||||