PT-2016-3504 · Linux+2 · Linux Kernel+2

Published 2015-06-03 · Updated 2016-08-12 · CVE-2014-9717

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.0.2

Description The issue allows local users to bypass intended access restrictions and navigate to filesystem locations beneath a mount by calling umount2 within a user namespace. This is due to the Linux kernel's failure to verify that the MNT LOCKED flag is unset when processing MNT DETACH umount2 system calls.

Recommendations For Linux kernel versions prior to 4.0.2, update to version 4.0.2 or later to resolve the issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2015-1485

ALT-PU-2015-1849

CVE-2014-9717

SUSE-SU-2016:1690-1

SUSE-SU-2016:1696-1

SUSE-SU-2016:1937-1

SUSE-SU-2016_1690-1

SUSE-SU-2016_1696-1

Affected Products

Alt Linux

Linux Kernel

Suse

References · 373

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/overlayfs_priv_esc.rb · Exploit
• 🔥 https://github.com/fi01/CVE-2015-3636 · Exploit
• 🔥 https://github.com/android-rooting-tools/libpingpong_exploit · Exploit
• 🔥 https://github.com/a7vinx/CVE-2015-3636 · Exploit
• 🔥 https://github.com/askk/libping_unhash_exploit_POC · Exploit
• 🔥 https://github.com/hhj4ck/CVE-2016-2067 · Exploit
• 🔥 https://github.com/x1ns4n3/CVE-2015-1328-GoldenEye · Exploit
• 🔥 https://github.com/0x1ns4n3/CVE-2015-1328-GoldenEye · Exploit
• 🔥 https://github.com/elit3pwner/CVE-2015-1328-GoldenEye · Exploit
• 🔥 https://github.com/betalphafai/CVE-2015-0568 · Exploit
• 🔥 https://github.com/betalphafai/cve-2015-3636_crash · Exploit
• https://github.com/torvalds/linux/commit/ce07d891a0891d3c0d0c2d73d577490486b809e1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01341 · Security Note
• https://bdu.fstec.ru/vul/2022-00886 · Security Note
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce07d891a0891d3c0d0c2d73d577490486b809e1 · Vendor Advisory