CVE-2016-1576

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: May 2, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-15777.6Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of CVE-2016-15789.8Use-after-free vulnerability in Oxide allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via CVE-2016-15799.8UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This CVE-2016-15809.8The setup_snappy_os_mounts function in the ubuntu-core-launcher package before 1.0.27.1 improperly determines the mount point of bind mounts CVE-2016-15815.5LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to CVE-2016-15825.5LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users t CVE-2016-15837.8The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cau CVE-2016-15845.3In all versions of Unity8 a running but not active application on a large-screen device could talk with Maliit and consume keyboard input.CVE-2016-15859.8In all versions of AppArmor mount rules are accidentally widened when compiled.CVE-2016-15867.5A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versi CVE-2016-15877.5The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the CVE-2016-15926.1XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the nrfEntitlementReport.d