NVD Vulnerability Detail

CVE-2015-8660

Summary	The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
Publication Date	Dec. 28, 2015, 8:59 p.m.
Registration Date	Jan. 26, 2021, 2:58 p.m.
Last Update	Nov. 21, 2024, 11:38 a.m.

CVSS3.1 : MEDIUM
スコア	6.7
Vector	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	高
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : HIGH
Score	7.2
Vector	AV:L/AC:L/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:linux:linux_kernel::::::::	4.2			4.4
cpe:2.3:o:linux:linux_kernel::::::::	3.19			4.1.22
cpe:2.3:o:linux:linux_kernel::::::::	3.18			3.18.31

Related information, measures and tools

No	URL	タグ
1	http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=acff81ec2c79492b180fade3c2894425cd35a545	Vendor Advisory
2	http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=acff81ec2c79492b180fade3c2894425cd35a545	Vendor Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00039.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00039.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00040.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00040.html	Mailing List Third Party Advisory
7	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00043.html	Mailing List Third Party Advisory
8	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00043.html	Mailing List Third Party Advisory
9	http://packetstormsecurity.com/files/135151/Ubuntu-14.04-LTS-15.10-overlayfs-Local-Root.html	Third Party Advisory VDB Entry
10	http://packetstormsecurity.com/files/135151/Ubuntu-14.04-LTS-15.10-overlayfs-Local-Root.html	Third Party Advisory VDB Entry
11	http://rhn.redhat.com/errata/RHSA-2016-1532.html	Third Party Advisory
12	http://rhn.redhat.com/errata/RHSA-2016-1532.html	Third Party Advisory
13	http://rhn.redhat.com/errata/RHSA-2016-1539.html	Third Party Advisory
14	http://rhn.redhat.com/errata/RHSA-2016-1539.html	Third Party Advisory
15	http://rhn.redhat.com/errata/RHSA-2016-1541.html	Third Party Advisory
16	http://rhn.redhat.com/errata/RHSA-2016-1541.html	Third Party Advisory
17	http://www.openwall.com/lists/oss-security/2015/12/23/5	Mailing List Third Party Advisory
18	http://www.openwall.com/lists/oss-security/2015/12/23/5	Mailing List Third Party Advisory
19	http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html	Third Party Advisory
20	http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html	Third Party Advisory
21	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html	Third Party Advisory
22	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html	Third Party Advisory
23	http://www.securityfocus.com/bid/79671	Third Party Advisory VDB Entry
24	http://www.securityfocus.com/bid/79671	Third Party Advisory VDB Entry
25	http://www.securitytracker.com/id/1034548	Third Party Advisory VDB Entry
26	http://www.securitytracker.com/id/1034548	Third Party Advisory VDB Entry
27	http://www.ubuntu.com/usn/USN-2857-1	Third Party Advisory
28	http://www.ubuntu.com/usn/USN-2857-1	Third Party Advisory
29	http://www.ubuntu.com/usn/USN-2857-2	Third Party Advisory
30	http://www.ubuntu.com/usn/USN-2857-2	Third Party Advisory
31	http://www.ubuntu.com/usn/USN-2858-1	Third Party Advisory
32	http://www.ubuntu.com/usn/USN-2858-1	Third Party Advisory
33	http://www.ubuntu.com/usn/USN-2858-2	Third Party Advisory
34	http://www.ubuntu.com/usn/USN-2858-2	Third Party Advisory
35	http://www.ubuntu.com/usn/USN-2858-3	Third Party Advisory
36	http://www.ubuntu.com/usn/USN-2858-3	Third Party Advisory
37	https://bugzilla.redhat.com/show_bug.cgi?id=1291329	Issue Tracking Third Party Advisory
38	https://bugzilla.redhat.com/show_bug.cgi?id=1291329	Issue Tracking Third Party Advisory
39	https://github.com/torvalds/linux/commit/acff81ec2c79492b180fade3c2894425cd35a545	Vendor Advisory
40	https://github.com/torvalds/linux/commit/acff81ec2c79492b180fade3c2894425cd35a545	Vendor Advisory
41	https://www.exploit-db.com/exploits/39166/	Third Party Advisory VDB Entry
42	https://www.exploit-db.com/exploits/39166/	Third Party Advisory VDB Entry
43	https://www.exploit-db.com/exploits/39230/	Third Party Advisory VDB Entry
44	https://www.exploit-db.com/exploits/39230/	Third Party Advisory VDB Entry
45	https://www.exploit-db.com/exploits/40688/	Third Party Advisory VDB Entry
46	https://www.exploit-db.com/exploits/40688/	Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

Linux Kernel の fs/overlayfs/inode.c の ovl_setattr 関数におけるアクセス制限を回避される脆弱性

Title	Linux Kernel の fs/overlayfs/inode.c の ovl_setattr 関数におけるアクセス制限を回避される脆弱性
Summary	Linux Kernel の fs/overlayfs/inode.c の ovl_setattr 関数は、異なる setattr オペレーションの結合を試みるため、アクセス制限を回避され、任意のオーバーレイファイルの属性を変更される脆弱性が存在します。
Possible impacts	ローカルユーザにより、巧妙に細工されたアプリケーションを介して、アクセス制限を回避され、任意のオーバーレイファイルの属性を変更される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 5, 2015, midnight
Registration Date	Jan. 5, 2016, 11:12 a.m.
Last Update	Sept. 6, 2016, 4:03 p.m.

Affected System

Linux

Linux Kernel 4.3.3 まで

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-8660	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8660
National Vulnerability Database (NVD)
2	CVE-2015-8660	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8660

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
GitHub
1	ovl: fix permission checking for setattr	https://github.com/torvalds/linux/commit/acff81ec2c79492b180fade3c2894425cd35a545
Linux Kernel
2	Linux Kernel Archives	http://www.kernel.org
Linux kernel source tree
3	ovl: fix permission checking for setattr	http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=acff81ec2c79492b180fade3c2894425cd35a545
Red Hat Bugzilla
4	Bug 1291329	https://bugzilla.redhat.com/show_bug.cgi?id=1291329
Red Hat Security Advisory
5	RHSA-2016:1532	http://rhn.redhat.com/errata/RHSA-2016-1532.html
6	RHSA-2016:1539	http://rhn.redhat.com/errata/RHSA-2016-1539.html
7	RHSA-2016:1541	http://rhn.redhat.com/errata/RHSA-2016-1541.html

Change Log

No	Changed Details	Date of change
0	[2016年01月05日] 掲載 [2016年09月06日] ベンダ情報：レッドハット (RHSA-2016:1532) を追加ベンダ情報：レッドハット (RHSA-2016:1539) を追加ベンダ情報：レッドハット (RHSA-2016:1541) を追加	Feb. 17, 2018, 10:37 a.m.