CVE - CVE-2015-8660

CVE-ID
CVE-2015-8660	Learn more at National Vulnerability Database (NVD) • Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings
Description
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
EXPLOIT-DB:39166 URL:https://www.exploit-db.com/exploits/39166/ EXPLOIT-DB:40688 URL:https://www.exploit-db.com/exploits/40688/ EXPLOIT-DB:39230 URL:https://www.exploit-db.com/exploits/39230/ MLIST:[oss-security] 20151223 CVE request -- linux kernel: overlay: fix permission checking for setattr URL:http://www.openwall.com/lists/oss-security/2015/12/23/5 MISC:http://packetstormsecurity.com/files/135151/Ubuntu-14.04-LTS-15.10-overlayfs-Local-Root.html CONFIRM:http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=acff81ec2c79492b180fade3c2894425cd35a545 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=1291329 CONFIRM:https://github.com/torvalds/linux/commit/acff81ec2c79492b180fade3c2894425cd35a545 CONFIRM:http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html CONFIRM:http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html REDHAT:RHSA-2016:1532 URL:http://rhn.redhat.com/errata/RHSA-2016-1532.html REDHAT:RHSA-2016:1539 URL:http://rhn.redhat.com/errata/RHSA-2016-1539.html REDHAT:RHSA-2016:1541 URL:http://rhn.redhat.com/errata/RHSA-2016-1541.html SUSE:SUSE-SU-2016:0751 URL:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00039.html SUSE:SUSE-SU-2016:0752 URL:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00040.html SUSE:SUSE-SU-2016:0755 URL:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00043.html UBUNTU:USN-2857-1 URL:http://www.ubuntu.com/usn/USN-2857-1 UBUNTU:USN-2857-2 URL:http://www.ubuntu.com/usn/USN-2857-2 UBUNTU:USN-2858-1 URL:http://www.ubuntu.com/usn/USN-2858-1 UBUNTU:USN-2858-2 URL:http://www.ubuntu.com/usn/USN-2858-2 UBUNTU:USN-2858-3 URL:http://www.ubuntu.com/usn/USN-2858-3 BID:79671 URL:http://www.securityfocus.com/bid/79671 SECTRACK:1034548 URL:http://www.securitytracker.com/id/1034548
Assigning CNA
N/A
Date Entry Created
20151223	Disclaimer: The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20151223)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE list, which standardizes names for security problems.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org