CVE-2015-8660

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 22.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-12-28 · updated 2026-06-17
Weakness: CWE-264

Description

The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.

Affected products

Linux kernel: from 3.18 before 3.18.31; from 3.19 before 4.1.22; from 4.2 before 4.4 — fixed in 3.18.31, 4.1.22, 4.4

How to fix

Upgrade to a fixed version: Linux kernel 3.18.31, 4.1.22, 4.4. Check the vendor advisory for mitigations.

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=acff81ec2c79492b180fade3c2894425cd35a545
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00039.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00040.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00043.html
http://packetstormsecurity.com/files/135151/Ubuntu-14.04-LTS-15.10-overlayfs-Local-Root.html
http://rhn.redhat.com/errata/RHSA-2016-1532.html
http://rhn.redhat.com/errata/RHSA-2016-1539.html
http://rhn.redhat.com/errata/RHSA-2016-1541.html
http://www.openwall.com/lists/oss-security/2015/12/23/5
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/bid/79671

Get alerted when CVE-2015-8660 or the next vulnerability affects your stack