CVE-2015-1328 Privilege escalation in n/a
Local attackers can gain root access via improper permission checks in the Linux kernel overlayfs implementation when permitted in arbitrary mount namespaces.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-1328?
CVE-2015-1328 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 28 Nov 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
Weakness: CWE-264
Which versions are affected by CVE-2015-1328?
It affects 2 products.
Products include Canonical Ubuntu Linux, Linux kernel.
How do I fix CVE-2015-1328?
Apply the vendor's patch.
Is CVE-2015-1328 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-1328 exists.
Public exploit code: 1 Metasploit module, 3 Exploit-DB entries and 11 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as GHSA-jhgp-x42x-cx6m, UBUNTU-CVE-2015-1328, USN-2643-1, USN-2644-1, USN-2645-1.