CVE-2016-2854

Опубликовано: 02 мая 2016

Источник: nvd

CVSS3: 7.8

CVSS2: 4.6

EPSS Низкий

Описание

The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.

Ссылки

http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/
Exploit
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/02/24/9
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/96838
Third Party Advisory
VDB Entry
https://sourceforge.net/p/aufs/mailman/message/34864744/
Third Party Advisory
http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/
Exploit
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/02/24/9
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/96838
Third Party Advisory
VDB Entry
https://sourceforge.net/p/aufs/mailman/message/34864744/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.19.8 (включая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.0.0 (включая) до 4.20.15 (включая)

EPSS

Процентиль: 57%

0.00348

Низкий

7.8 High

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-269

Связанные уязвимости

CVE-2016-2854

CVSS3: 7.8

ubuntu

почти 10 лет назад

The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.

CVE-2016-2854

redhat

почти 10 лет назад

The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.

CVE-2016-2854

CVSS3: 7.8

debian

почти 10 лет назад

The aufs module for the Linux kernel 3.x and 4.x does not properly mai ...

GHSA-mx43-7754-cfh2

CVSS3: 7.8

github

больше 3 лет назад

The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.

EPSS

Процентиль: 57%

0.00348

Низкий

7.8 High

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-269