Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-1576

21 documents8 sources
Severity
7.8HIGH
EPSS
0.4%
top 42.39%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
4
Linux Linux KernelCanonical Ubuntu CoreCanonical Ubuntu Linux+1 more
Timeline
PublishedMay 2
Latest updateMay 13

Description

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages8 packages

▶Debianlinux< 4.5.1-1+3
▶Ubuntulinux< 3.13.0-79.123
▶Ubuntulinux-lts-wily< 4.2.0-30.35~14.04.1
▶Ubuntulinux-lts-vivid< 3.19.0-51.57~14.04.1

Also affects: Ubuntu Linux 12.04, 14.04, 15.10, 16.04, 16.10

Patches

Patch: git.kernel.org ↗Patch: launchpadlibrarian.net ↗Patch: launchpadlibrarian.net ↗

🔴Vulnerability Details

10
GHSA
GHSA-6774-jh98-f2hq: The overlayfs implementation in the Linux kernel through 4↗2022-05-13
▶
CVEList
CVE-2016-1576: The overlayfs implementation in the Linux kernel through 4↗2016-05-02
▶
OSV
CVE-2016-1576: The overlayfs implementation in the Linux kernel through 4↗2016-05-02
▶
OSV
linux-lts-vivid regression↗2016-02-27
▶
OSV
linux-lts-utopic regression↗2016-02-27
▶

💥Exploits & PoCs

1
Exploit-DB
Ubuntu 15.10 - 'USERNS ' Overlayfs Over Fuse Privilege Escalation↗2016-11-22
▶

📋Vendor Advisories

9
Ubuntu
Linux kernel vulnerabilities↗2016-02-22
▶
Ubuntu
Linux kernel (Vivid HWE) vulnerabilities↗2016-02-22
▶
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerabilities↗2016-02-22
▶
Ubuntu
Linux kernel (Utopic HWE) vulnerabilities↗2016-02-22
▶
Ubuntu
Linux kernel (Wily HWE) vulnerabilities↗2016-02-22
▶
CVE-2016-1576 (HIGH CVSS 7.8) | The overlayfs implementation in the | cvebase.io