CVE-2016-2853

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-05-02 · updated 2026-06-17
Weakness: CWE-269

Description

The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an aufs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.

Affected products

Linux kernel: from 3.0.0 through 3.19.8; from 4.0.0 through 4.20.15

References

http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/
http://www.openwall.com/lists/oss-security/2016/02/24/9
http://www.openwall.com/lists/oss-security/2021/10/18/1
http://www.securityfocus.com/bid/96839
https://sourceforge.net/p/aufs/mailman/message/34864744/
http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/
http://www.openwall.com/lists/oss-security/2016/02/24/9
http://www.openwall.com/lists/oss-security/2021/10/18/1
http://www.securityfocus.com/bid/96839
https://sourceforge.net/p/aufs/mailman/message/34864744/

Get alerted when CVE-2016-2853 or the next vulnerability affects your stack