CVE-2015-1328: overlayfs missing permission check on file creation in the upper directory (unprivileged userns)
Scope: audit · README · COMPARISON · docs/RESEARCH
Exploited in the wild (CISA KEV). Fixed: Ubuntu 14.10 3.16.0-41.55, 15.04 3.19.0-21.21, 14.04 3.13.0-55.92.
Source
Relevance to doos
The oldest of the overlayfs-in-userns bugs in this audit: overlayfs did not check permissions when creating files in the upper directory, reachable from CONFIG_USER_NS=y kernels where overlayfs carries FS_USERNS_MOUNT, the default on the Ubuntu releases of that era and the same precondition doos depends on today. Kept in the list to complete the history of this bug class, not because current kernels are expected to be exposed.
What the check does
Kernel version check against the three listed fixed builds; on any host from the last several years this is expected to PASS trivially, included to complete the category.
Caveats
Same distro-backport blind spot as the newer overlayfs entries: a version string alone cannot prove a specific vendor backport is present.
Run: make test in this directory, or make -C audit test from the repo root.