What’s Vulnerable › Vulnerabilities

CVE-2016-1576

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-05-02 · updated 2026-06-17

Description

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.

Affected products

• Canonical Ubuntu Core: 15.04
• Canonical Ubuntu Linux: 12.04, 14.04, 15.10, 16.04, 16.10
• Canonical Ubuntu Touch: 15.04
• Linux kernel: through 4.5.2

References

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79360
• http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1576.html
• http://www.halfdog.net/Security/2016/OverlayfsOverFusePrivilegeEscalation/
• http://www.openwall.com/lists/oss-security/2016/02/24/8
• http://www.openwall.com/lists/oss-security/2021/10/18/1
• https://bugs.launchpad.net/bugs/1535150
• https://launchpadlibrarian.net/235300093/0005-overlayfs-Be-more-careful-about-copying-up-sxid-file.patch
• https://launchpadlibrarian.net/235300225/0006-overlayfs-Propogate-nosuid-from-lower-and-upper-moun.patch
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79360
• http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1576.html
• http://www.halfdog.net/Security/2016/OverlayfsOverFusePrivilegeEscalation/
• http://www.openwall.com/lists/oss-security/2016/02/24/8

Get alerted when CVE-2016-1576 or the next vulnerability affects your stack