PT-2015-7820 · Linux+3 · Linux Kernel+3

Jann Horn · Published 2015-12-12 · Updated 2024-08-06 · CVE-2015-8709

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.4.1

Description The Linux kernel mishandles uid and gid mappings, which allows local users to gain privileges by establishing a user namespace, waiting for a root process to enter that namespace with an unsafe uid or gid, and then using the ptrace system call. The vendor states that there is no kernel bug.

Recommendations For Linux kernel versions through 4.4.1, consider updating to a version later than 4.4.1 to resolve the issue. As a temporary workaround, consider restricting the use of the ptrace system call to minimize the risk of exploitation. Additionally, be cautious when using user namespaces and ensure that uid and gid mappings are handled safely.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2016-1137

ALT-PU-2016-1485

CVE-2015-8709

DSA-3434-1

OPENSUSE-SU-2016_1008-1

OPENSUSE-SU-2016_2144-1

OPENSUSE-SU-2017_0456-1

SUSE-SU-2016:0785-1

SUSE-SU-2016:1019-1

SUSE-SU-2016:1031-1

SUSE-SU-2016:1032-1

SUSE-SU-2016:1033-1

SUSE-SU-2016:1034-1

SUSE-SU-2016:1035-1

SUSE-SU-2016:1037-1

SUSE-SU-2016:1038-1

SUSE-SU-2016:1039-1

SUSE-SU-2016:1040-1

SUSE-SU-2016:1041-1

SUSE-SU-2016:1045-1

SUSE-SU-2016:1046-1

SUSE-SU-2016:1764-1

SUSE-SU-2017:0575-1

SUSE-SU-2017_0575-1

USN-2847-1

USN-2848-1

USN-2849-1

USN-2850-1

USN-2851-1

USN-2852-1

USN-2853-1

USN-2854-1

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 701

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/overlayfs_priv_esc.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/netfilter_priv_esc_ipv4.rb · Exploit
• 🔥 https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-2384 · Exploit
• 🔥 https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-9793 · Exploit
• 🔥 https://github.com/Kagami/docker_cve-2015-2925 · Exploit
• 🔥 https://github.com/whu-enjoy/CVE-2015-8660 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-8709 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7566 · Security Note
• https://ubuntu.com/security/CVE-2015-8709 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8962 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00026.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8709 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2550 · Security Note
• https://errata.altlinux.org/ALT-PU-2016-1137 · Vendor Advisory