// For flags

CVE-2016-2856

Ubuntu < 15.10 - PT Chown Arbitrary PTs Access Via User Namespace Privilege Escalation

Severity Score

8.4
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS and before 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS; and the glibc package before 2.21-0ubuntu4.2 on Ubuntu 15.10 and before 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10 lacks a namespace check associated with file-descriptor passing, which allows local users to capture keystrokes and spoof data, and possibly gain privileges, via pts read and write operations, related to debian/sysdeps/linux.mk. NOTE: this is not considered a vulnerability in the upstream GNU C Library because the upstream documentation has a clear security recommendation against the --enable-pt_chown option.

pt_chown en el paquete glibc en versiones anteriores a 2.19-18+deb8u4 en Debian jessie; el paquete elibc en versiones anteriores a 2.15-0ubuntu10.14 en Ubuntu 12.04 LTS y en versiones anteriores a 2.19-0ubuntu6.8 en Ubuntu 14.04 LTS; y el paquete glibc en versiones anteriores a 2.21-0ubuntu4.2 en Ubuntu 15.10 y en versiones anteriores a 2.23-0ubuntu1 en Ubuntu 16.04 LTS y 16.10 carece de verificación de paso de espacio de nombres asociado a la ejecución del descriptor de archivo, lo que permite a usuarios locales capturar pulsaciones del teclado y suplantar datos, y posiblemente obtener privilegios, a través de operaciones pts de lectura y escritura, relacionado con debian/sysdeps/linux.mk. NOTA: no está considerada una vulnerabilidad inicial en la GNU C Library porque la documentación de distribución tiene una clara recomendación de seguridad frente a la opción --enable-pt_chown.

Ubuntu versions prior to 15.10 suffer from a PT chown arbitrary PTs access via user namespace privilege escalation vulnerability.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2015-05-26 CVE Published
  • 2016-02-22 First Exploit
  • 2016-03-06 CVE Reserved
  • 2023-03-07 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-264: Permissions, Privileges, and Access Controls
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 8.0
Search vendor "Debian" for product "Debian Linux" and version "8.0"
-
Affected
in Gnu
Search vendor "Gnu"
 Glibc
Search vendor "Gnu" for product "Glibc"
 <= 2.18
Search vendor "Gnu" for product "Glibc" and version " <= 2.18"
-
Safe
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 12.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04"
lts
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 14.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04"
lts
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 15.10
Search vendor "Canonical" for product "Ubuntu Linux" and version "15.10"
-
Affected