CVE-2015-2925 : The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does n

The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."

Published 2015-11-16 11:59:00

Updated 2024-07-17 15:29:50

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2015-2925

Debian » Debian Linux » Version: 7.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.19 and before (<) 4.1.11
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.3 and before (<) 3.4.110
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.17 and before (<) 3.18.23
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.15 and before (<) 3.16.35
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.2 and before (<) 4.2.4
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions before (<) 3.2.72
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.5 and before (<) 3.10.91
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.11 and before (<) 3.12.49
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.13 and before (<) 3.14.55
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 15.04
cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-2925

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 8 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-2925

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.9	MEDIUM	AV:L/AC:M/Au:N/C:C/I:C/A:C	3.4	10.0	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

References for CVE-2015-2925

http://www.debian.org/security/2015/dsa-3364

Debian -- Security Information -- DSA-3364-1 linux
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html

[security-announce] SUSE-SU-2015:2194-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://pkgs.fedoraproject.org/cgit/kernel.git/commit/?h=f22&id=520b64102de2f184036024b2a53de2b67463bd78

Page not found :'( - src.fedoraproject.org
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00021.html

[security-announce] SUSE-SU-2016:0386-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://permalink.gmane.org/gmane.linux.kernel.containers/29177

Broken Link
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.4

Vendor Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00019.html

[security-announce] SUSE-SU-2016:0383-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cde93be45a8a90d8c264c776fab63487b5038a65

kernel/git/torvalds/linux.git - Linux kernel source tree
Third Party Advisory
http://www.ubuntu.com/usn/USN-2794-1

USN-2794-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=397d425dc26da728396e66d392d5dcb8dac30c37

kernel/git/torvalds/linux.git - Linux kernel source tree
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1209373

1209373 – CVE-2015-2925 Kernel: vfs: Do not allow escaping from bind mounts [fedora-all]
Issue Tracking;Third Party Advisory
http://www.securityfocus.com/bid/73926

Linux Kernel CVE-2015-2925 Local Privilege Escalation Vulnerability
Third Party Advisory;VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00009.html

[security-announce] SUSE-SU-2016:0337-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
https://github.com/torvalds/linux/commit/397d425dc26da728396e66d392d5dcb8dac30c37

vfs: Test for and handle paths that are unreachable from their mnt_root · torvalds/linux@397d425 · GitHub
Third Party Advisory
http://www.ubuntu.com/usn/USN-2792-1

USN-2792-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00007.html

[security-announce] SUSE-SU-2016:0335-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Oracle Linux Bulletin - October 2015
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2798-1

USN-2798-1: Linux kernel (Vivid HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Oracle Linux Bulletin - January 2016
Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2015/04/04/4

oss-security - Re: Linux namespaces: It is possible to escape from bind mounts
Mailing List;Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00020.html

[security-announce] SUSE-SU-2016:0384-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00017.html

[security-announce] SUSE-SU-2016:0380-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00018.html

[security-announce] SUSE-SU-2016:0381-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2015-2636.html

RHSA-2015:2636 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00022.html

[security-announce] SUSE-SU-2016:0387-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html

[security-announce] SUSE-SU-2015:2292-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.debian.org/security/2015/dsa-3372

Debian -- Security Information -- DSA-3372-1 linux
Third Party Advisory

CVEs referencing this url
https://github.com/torvalds/linux/commit/cde93be45a8a90d8c264c776fab63487b5038a65

dcache: Handle escaped paths in prepend_path · torvalds/linux@cde93be · GitHub
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00034.html

[security-announce] SUSE-SU-2016:0434-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=1209367

1209367 – (CVE-2015-2925) CVE-2015-2925 Kernel: vfs: Do not allow escaping from bind mounts
Issue Tracking;Third Party Advisory
http://www.ubuntu.com/usn/USN-2795-1

USN-2795-1: Linux kernel (Trusty HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2799-1

USN-2799-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://permalink.gmane.org/gmane.linux.kernel.containers/29173

Broken Link
http://rhn.redhat.com/errata/RHSA-2016-0068.html

RHSA-2016:0068 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2015-2925

Products affected by CVE-2015-2925

Exploit prediction scoring system (EPSS) score for CVE-2015-2925

CVSS scores for CVE-2015-2925

References for CVE-2015-2925