CVE-2016-2853 - Vulnerability Details - OpenCVE

The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an aufs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/
http://www.openwall.com/lists/oss-security/2016/02/24/9
http://www.openwall.com/lists/oss-security/2021/10/18/1
http://www.securityfocus.com/bid/96839
https://nvd.nist.gov/vuln/detail/CVE-2016-2853
https://sourceforge.net/p/aufs/mailman/message/34864744/
https://www.cve.org/CVERecord?id=CVE-2016-2853

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2016-05-02T10:00:00

Updated: 2024-08-05T23:32:21.339Z

Reserved: 2016-03-06T00:00:00

Link: CVE-2016-2853

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2016-05-02T10:59:33.160

Modified: 2025-04-12T10:46:40.837

Link: CVE-2016-2853

Redhat

Severity :

Publid Date: 2016-02-24T00:00:00Z

Links: CVE-2016-2853 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-02-19T00:00:00", "descriptions": [{"lang": "en", "value": "The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an aufs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-10-18T20:06:12", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "96839", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/96839"}, {"tags": ["x_refsource_MISC"], "url": "http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/"}, {"name": "[oss-security] 20160224 Aufs Union Filesystem Privilege Escalation In User Namespaces", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/02/24/9"}, {"name": "[aufs] 20160219 aufs3 and aufs4 GIT release", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://sourceforge.net/p/aufs/mailman/message/34864744/"}, {"name": "[oss-security] 20211018 Re: CVE-2021-3847: OverlayFS - Potential Privilege Escalation using overlays copy_up", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2021/10/18/1"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-2853", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an aufs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "96839", "refsource": "BID", "url": "http://www.securityfocus.com/bid/96839"}, {"name": "http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/", "refsource": "MISC", "url": "http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/"}, {"name": "[oss-security] 20160224 Aufs Union Filesystem Privilege Escalation In User Namespaces", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/02/24/9"}, {"name": "[aufs] 20160219 aufs3 and aufs4 GIT release", "refsource": "MLIST", "url": "https://sourceforge.net/p/aufs/mailman/message/34864744/"}, {"name": "[oss-security] 20211018 Re: CVE-2021-3847: OverlayFS - Potential Privilege Escalation using overlays copy_up", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2021/10/18/1"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T23:32:21.339Z"}, "title": "CVE Program Container", "references": [{"name": "96839", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/96839"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/"}, {"name": "[oss-security] 20160224 Aufs Union Filesystem Privilege Escalation In User Namespaces", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/02/24/9"}, {"name": "[aufs] 20160219 aufs3 and aufs4 GIT release", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://sourceforge.net/p/aufs/mailman/message/34864744/"}, {"name": "[oss-security] 20211018 Re: CVE-2021-3847: OverlayFS - Potential Privilege Escalation using overlays copy_up", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2021/10/18/1"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-2853", "datePublished": "2016-05-02T10:00:00", "dateReserved": "2016-03-06T00:00:00", "dateUpdated": "2024-08-05T23:32:21.339Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "480F226E-935E-4AA0-AEDC-7A164F28B1A0", "versionEndIncluding": "3.19.8", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FF42CEC-BC1A-4932-AD2D-004152E895B3", "versionEndIncluding": "4.20.15", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an aufs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program."}, {"lang": "es", "value": "El m\u00f3dulo aufs para el kernel de Linux 3.x y 4.x no restringe correctamente el espacio de nombres de montaje, lo que permite a usuarios locales obtener privilegos montando un sistema de archivos aufs sobre un sistema de archivos FUSE y luego ejecutando un programa setuid manipulado."}], "id": "CVE-2016-2853", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-05-02T10:59:33.160", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/02/24/9"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/10/18/1"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://www.securityfocus.com/bid/96839"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://sourceforge.net/p/aufs/mailman/message/34864744/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/02/24/9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/10/18/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://www.securityfocus.com/bid/96839"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://sourceforge.net/p/aufs/mailman/message/34864744/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}]}