4.6
CVSSv2

CVE-2016-2854

Published: 02/05/2016 Updated: 07/08/2020
CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 465
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

It exists that the aufs file system in the Linux kernel did not properly maintain POSIX ACL xattr data, when mounted with the non-default allow_userns option. A local attacker could possibly use this to gain elevated privileges. (CVE-2016-2854) ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

linux linux kernel

Vendor Advisories

Several security issues were fixed in the Linux kernel ...

Exploits

Source: wwwhalfdognet/Security/2016/AufsPrivilegeEscalationInUserNamespaces/ ## Introduction Problem description: Aufs is a union filesystem to mix content of different underlying filesystems, eg read-only medium with r/w RAM-fs That is also allowed in user namespaces when module was loaded with allow_userns option Due to different b ...