CVE-2015-2925: Path Traversal
A flaw was found in the way the Linux kernel's file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a container could use this flaw to escape the bind mount and, potentially, escalate their privileges on the system.
Other sources
Linux kernel built with the name spaces support(CONFIGNAMESPACE) is vulnerable to a potential privilege escalation flaw. It could occur when a process within a container escapes the intended bind mounts to access the full file system.
A privileged user inside a container could use this flaw to potentially gain full privileges on a system.
Upstream fix: ------------- -> http://permalink.gmane.org/gmane.linux.kernel.containers/29177
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2015/04/03/7
— Red Hat
The prependpath function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2015-2925.
What is the severity level of CVE-2015-2925?
CVE-2015-2925 has a severity level of high (7).
How does the vulnerability in CVE-2015-2925 affect Linux kernel versions?
The vulnerability in CVE-2015-2925 affects Linux kernel versions before 4.2.4.
What is the impact of CVE-2015-2925?
CVE-2015-2925 allows a privileged user inside a container to escape a bind mount, potentially escalating their privileges.
Are there any references or additional information available about CVE-2015-2925?
Yes, you can find more information about CVE-2015-2925 in the references: [1], [2], [3].