CVE-2016-1575

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79360Patch, Vendor Advisory
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1575.htmlThird Party Advisory
http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/Exploit, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/02/24/7Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/18/1Mailing List, Third Party Advisory
https://launchpad.net/bugs/1534961Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79360Patch, Vendor Advisory
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1575.htmlThird Party Advisory
http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/Exploit, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/02/24/7Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/18/1Mailing List, Third Party Advisory
https://launchpad.net/bugs/1534961Third Party Advisory

Timeline

Published: May 2, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-15767.8The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to g CVE-2016-15777.6Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of CVE-2016-15789.8Use-after-free vulnerability in Oxide allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via CVE-2016-15799.8UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This CVE-2016-15809.8The setup_snappy_os_mounts function in the ubuntu-core-launcher package before 1.0.27.1 improperly determines the mount point of bind mounts CVE-2016-15815.5LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to CVE-2016-15825.5LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users t CVE-2016-15837.8The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cau CVE-2016-15845.3In all versions of Unity8 a running but not active application on a large-screen device could talk with Maliit and consume keyboard input.CVE-2016-15859.8In all versions of AppArmor mount rules are accidentally widened when compiled.CVE-2016-15867.5A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versi CVE-2016-15877.5The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the