CVE-2016-1575

· HIGHModified

← All CVEs

CVSS v3.1

7.8

EPSS

0.92%

Published

May 2, 2016

Modified

May 6, 2026

Public PoC / Exploit (2)

All weaponized →

Exploit-DBUbuntu 14.04/15.10 - User Namespace Overlayfs Xattr SetGID Privilege Escalation TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-269

Affected Products (8)

linux · linux_kernelvulnerable

canonical · ubuntu_corevulnerable

canonical · ubuntu_linuxvulnerable

canonical · ubuntu_touchvulnerable

References (12)

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79360

PatchVendor Advisory

http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1575.html

Third Party Advisory

http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/

ExploitThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/02/24/7

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/18/1

Mailing ListThird Party Advisory

https://launchpad.net/bugs/1534961

Third Party Advisory

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79360

PatchVendor Advisory

http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1575.html

Third Party Advisory

http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/

ExploitThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/02/24/7

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/18/1

Mailing ListThird Party Advisory

https://launchpad.net/bugs/1534961

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs