34 lines
1.4 KiB
Markdown
34 lines
1.4 KiB
Markdown
# CVE-2015-1328: overlayfs missing permission check on file creation in the upper directory (unprivileged userns)
|
|
|
|
**Scope:** [audit](../README.md) · [README](../../README.md) · [COMPARISON](../../COMPARISON.md) · [docs/RESEARCH](../../docs/RESEARCH.md)
|
|
|
|
Exploited in the wild (CISA KEV). Fixed: Ubuntu 14.10 3.16.0-41.55, 15.04 3.19.0-21.21, 14.04 3.13.0-55.92.
|
|
|
|
## Source
|
|
|
|
- [Ubuntu advisory](https://ubuntu.com/security/CVE-2015-1328)
|
|
- [oss-security disclosure thread](https://openwall.com/lists/oss-security/2015/06/16/7)
|
|
|
|
## Relevance to doos
|
|
|
|
The oldest of the overlayfs-in-userns bugs in this audit: overlayfs did not check
|
|
permissions when creating files in the upper directory, reachable from CONFIG_USER_NS=y
|
|
kernels where overlayfs carries FS_USERNS_MOUNT, the default on the Ubuntu releases of
|
|
that era and the same precondition doos depends on today. Kept in the list to complete
|
|
the history of this bug class, not because current kernels are expected to be exposed.
|
|
|
|
|
|
## What the check does
|
|
|
|
Kernel version check against the three listed fixed builds; on any host from the last
|
|
several years this is expected to PASS trivially, included to complete the category.
|
|
|
|
|
|
## Caveats
|
|
|
|
Same distro-backport blind spot as the newer overlayfs entries: a version string alone
|
|
cannot prove a specific vendor backport is present.
|
|
|
|
|
|
Run: `make test` in this directory, or `make -C audit test` from the repo root.
|