Kernel: vfs: Do not allow escaping from bind mounts

A flaw was found in the way the Linux kernel's file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a container could use this flaw to escape the bind mount and, potentially, escalate their...

Kernel: vfs: Do not allow escaping from bind mounts

A flaw was found in the way the Linux kernel's file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a container could use this flaw to escape the bind mount and, potentially, escalate their...

Linux kernel local elevation of privilege vulnerability (CNVD-2015-07700)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A security vulnerability exists in the 'prependpath' function in the fs/dcache.c file in Linux kernel 4.2.3 and earlier. Due to the program failing to properly handle rename...

DEBIAN-CVE-2015-2925

The prependpath function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."...

Oracle: Security Advisory (ELSA-2015-3037)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2015-1335

lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a 1 mount target or 2 bind mount source...

UBUNTU-CVE-2015-1334

attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux confinement by mounting a proc filesystem with a crafted 1 AppArmor profile or 2 SELinux label...

docker: volume mounts allow LSM profile escalation

Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules LSM and dockert policies via an image that allows volumes to override files in /proc...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerability (USN-2642-1)

Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system. Note that Tenable Network Security has extracted the preceding description block directly from the Ubunt...

USN-2647-1: Linux kernel vulnerability

Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system...

USN-2645-1 linux-lts-vivid vulnerability

Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system...

SUSE SLES12 Security Update : docker (SUSE-SU-2015:0082-1)

This docker version upgrade fixes the following security and non security issues, and adds the also additional features : - Updated to 1.4.1 2014-12-15 : - Runtime : - Fix issue with volumes-from and bind mounts not being honored after create fixes bnc913213 - Added e2fsprogs as runtime dependenc...

SUSE SLES10 Security Update : nfs-utils (SUSE-SU-2013:1668-1)

nfs-utils receives hereby a LTSS roll-up security and bugfix update. - CVE-2013-1923: Allow DNS lookups to be avoided when determining kerberos identity of server. The NFSGSSDAVOIDDNS sysconfig variable must to be set for this to take full effect as some installations could be negatively affected...

PT-2015-5979 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.2.4 Description: The issue allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack." This occurs because the prepend path function in...

SUSE-SU-2015:1020-1 Security update for autofs

autofs was updated to fix one security issue. This security issue was fixed: - CVE-2014-8169: Prevent potential privilege escalation via interpreter load path for program-based automount maps bnc917977. These non-security issues were fixed: - Dont pass sloppy option for other than nfs mounts...

docker: multiple issues

CVE-2014-9356 path traversal Path traversal attacks are possible in the processing of absolute symlinks. In checking symlinks for traversals, only relative links were considered. This allowed path traversals to exist where they should have otherwise been prevented. This was exploitable via both...

USN-2318-1 linux vulnerabilities

Eric W. Biederman discovered a flaw with the mediation of mount flags in the Linux kernel's user namespace subsystem. An unprivileged user could exploit this flaw to by-pass mount restrictions, and potentially gain administrative privileges. CVE-2014-5207 Kenton Varda discovered a flaw with...

USN-2317-1: Linux kernel (Trusty HWE) vulnerabilities

Eric W. Biederman discovered a flaw with the mediation of mount flags in the Linux kernel's user namespace subsystem. An unprivileged user could exploit this flaw to by-pass mount restrictions, and potentially gain administrative privileges. CVE-2014-5207 Kenton Varda discovered a flaw with...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2318-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2318-1 advisory. Eric W. Biederman discovered a flaw with the mediation of mount flags in the Linux kernel's user namespace subsystem. An unprivileged user could exploit...

PT-2014-6345 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.16.2 Description: The issue allows local users to bypass an intended read-only restriction and defeat certain sandbox protection mechanisms. This is achieved via a "mount -o remount" command within a user...