CVE-2015-8660 : The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3

The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.

Published 2015-12-28 11:59:08

Updated 2023-06-07 12:44:35

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2015-8660

Linux » Linux Kernel
Versions from including (>=) 3.18 and before (<) 3.18.31
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.2 and before (<) 4.4
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.19 and before (<) 4.1.22
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-8660

EPSS FAQ

0.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 44 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2015-8660

Overlayfs Privilege Escalation

Disclosure Date: 2015-06-16

First seen: 2020-04-26

exploit/linux/local/overlayfs_priv_esc

This module attempts to exploit two different CVEs related to overlayfs. CVE-2015-1328: Ubuntu specific -> 3.13.0-24 (14.04 default) < 3.13.0-55 3.16.0-25 (14.10 default) < 3.16.0-41 3.19.0-1

More information

CVSS scores for CVE-2015-8660

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2015-8660

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-8660

http://rhn.redhat.com/errata/RHSA-2016-1541.html

RHSA-2016:1541 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://github.com/torvalds/linux/commit/acff81ec2c79492b180fade3c2894425cd35a545

ovl: fix permission checking for setattr · torvalds/linux@acff81e · GitHub
Vendor Advisory
http://www.ubuntu.com/usn/USN-2857-1

USN-2857-1: Linux kernel vulnerability | Ubuntu security notices
Third Party Advisory
http://www.securityfocus.com/bid/79671

Linux Kernel 'fs/overlayfs/inode.c' Local Privilege Escalation Vulnerability
Third Party Advisory;VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00039.html

[security-announce] SUSE-SU-2016:0751-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.exploit-db.com/exploits/39166/

Linux Kernel 4.3.3 (Ubuntu 14.04/15.10) - 'overlayfs' Local Privilege Escalation (1)
Third Party Advisory;VDB Entry
http://www.openwall.com/lists/oss-security/2015/12/23/5

oss-security - CVE request -- linux kernel: overlay: fix permission checking for setattr
Mailing List;Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1291329

1291329 – (CVE-2015-8660) CVE-2015-8660 kernel: Permission bypass on overlayfs during copy_up
Issue Tracking;Third Party Advisory
https://www.exploit-db.com/exploits/40688/

Linux Kernel (Ubuntu / Fedora / RedHat) - 'Overlayfs' Local Privilege Escalation (Metasploit)
Third Party Advisory;VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00043.html

[security-announce] SUSE-SU-2016:0755-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.exploit-db.com/exploits/39230/

Linux Kernel 4.3.3 - 'overlayfs' Local Privilege Escalation (2)
Third Party Advisory;VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-1539.html

RHSA-2016:1539 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=acff81ec2c79492b180fade3c2894425cd35a545

kernel/git/torvalds/linux.git - Linux kernel source tree
Vendor Advisory
http://www.securitytracker.com/id/1034548

Linux Kernel Overlayfs Security Permissions Flaw Lets Local Users Bypass Security Restrictions - SecurityTracker
Third Party Advisory;VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00040.html

[security-announce] SUSE-SU-2016:0752-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2858-3

USN-2858-3: Linux kernel (Raspberry Pi 2) vulnerability | Ubuntu security notices
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Oracle VM Server for x86 Bulletin - July 2016
Third Party Advisory

CVEs referencing this url
http://packetstormsecurity.com/files/135151/Ubuntu-14.04-LTS-15.10-overlayfs-Local-Root.html

Ubuntu 14.04 LTS / 15.10 overlayfs Local Root ≈ Packet Storm
Third Party Advisory;VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-1532.html

RHSA-2016:1532 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2858-1

USN-2858-1: Linux kernel vulnerability | Ubuntu security notices
Third Party Advisory
http://www.ubuntu.com/usn/USN-2857-2

USN-2857-2: Linux kernel (Vivid HWE) vulnerability | Ubuntu security notices
Third Party Advisory
http://www.ubuntu.com/usn/USN-2858-2

USN-2858-2: Linux kernel (Wily HWE) vulnerability | Ubuntu security notices
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Oracle Linux Bulletin - July 2016
Third Party Advisory

CVEs referencing this url

Jump to