CVE-2016-2854
First published: Mon May 02 2016(Updated: )
Last updated 25 October 2024
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Linux kernel | >=3.0.0<=3.19.8 | |
| Linux Linux kernel | >=4.0.0<=4.20.15 | |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.112-1 6.11.5-1 6.11.7-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/
- http://www.openwall.com/lists/oss-security/2016/02/24/9
- http://www.securityfocus.com/bid/96838
- https://sourceforge.net/p/aufs/mailman/message/34864744/
- https://launchpad.net/bugs/cve/CVE-2016-2854
- https://security-tracker.debian.org/tracker/CVE-2016-2854
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2854
- https://nvd.nist.gov/vuln/detail/CVE-2016-2854
- https://ubuntu.com/security/CVE-2016-2854
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2016-2854.
What is the description of the vulnerability?
The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.
Which software is affected by this vulnerability?
The Linux kernel versions 3.x and 4.x.
How can local users exploit this vulnerability?
By leveraging a group-writable setgid directory.
Are there any remediation steps available for this vulnerability?
Yes, updating to Linux kernel version 4.4.0-222.255 or higher will address this vulnerability.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/description
- agent/weakness
- agent/severity
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/3.0.0
- version/linux linux kernel/3.19.8
- version/linux linux kernel/4.0.0
- version/linux linux kernel/4.20.15
- package-manager/debian