CVE-2015-8660

[Serge Hallyn]

The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.

Break-Fix: e9be9d5e76e34872f0c37d72e25bc27fe9e2c54c acff81ec2c79492b180fade3c2894425cd35a545

[Kamal Mostafa (kamalmostafa)]

[corrected]:

The fix commit (acff81e "ovl: fix permission checking for setattr") applies cleanly to Vivid (already committed), Wily, and Xenial.

By code inspection, it appears to me that the older version of overlayfs in releases <= Utopic is not vulnerable to this exploit: their ovl_setattr() already calls a copy_up first thing, like the fix patch does.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Tyler Hicks (tyhicks)]

Making this bug public since all the details in this bug are already public.

[Andy Whitcroft (apw)]

I have installed VMs with the various combinations and tried the POC as supplied with each. I confirm that only vivid and later are exposed by the exploit.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.2.0-23.28

---------------
linux (4.2.0-23.28) wily; urgency=low

  [ Andy Whitcroft ]

  * Release Tracking Bug
    - LP: #1529361

  [ Upstream Kernel Changes ]

  * ovl: fix permission checking for setattr
    - LP: #1528904
    - CVE-2015-8660

 -- Andy Whitcroft <email address hidden> Sat, 26 Dec 2015 09:42:47 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.19.0-43.49

---------------
linux (3.19.0-43.49) vivid; urgency=low

  [ Andy Whitcroft ]

  * Release Tracking Bug
    - LP: #1529362

  [ Upstream Kernel Changes ]

  * ovl: fix permission checking for setattr
    - LP: #1528904
    - CVE-2015-8660

 -- Andy Whitcroft <email address hidden> Sat, 26 Dec 2015 09:48:24 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-vivid - 3.19.0-43.49~14.04.1

---------------
linux-lts-vivid (3.19.0-43.49~14.04.1) trusty; urgency=low

  [ Andy Whitcroft ]

  * Release Tracking Bug
    - LP: #1529971

  [ Upstream Kernel Changes ]

  * ovl: fix permission checking for setattr
    - LP: #1528904
    - CVE-2015-8660

 -- Andy Whitcroft <email address hidden> Sat, 26 Dec 2015 09:48:24 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-raspi2 - 4.2.0-1018.25

---------------
linux-raspi2 (4.2.0-1018.25) wily; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1529992
  * rebased on Ubuntu-4.2.0-23.28

  [ Ubuntu: 4.2.0-23.28 ]

  * Release Tracking Bug
    - LP: #1529361
  * ovl: fix permission checking for setattr
    - LP: #1528904
    - CVE-2015-8660

 -- Luis Henriques <email address hidden> Mon, 04 Jan 2016 10:57:53 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-wily - 4.2.0-23.28~14.04.1

---------------
linux-lts-wily (4.2.0-23.28~14.04.1) trusty; urgency=low

  [ Andy Whitcroft ]

  * Release Tracking Bug
    - LP: #1529993

  [ Upstream Kernel Changes ]

  * ovl: fix permission checking for setattr
    - LP: #1528904
    - CVE-2015-8660

 -- Andy Whitcroft <email address hidden> Sat, 26 Dec 2015 09:42:47 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.3.0-6.17

---------------
linux (4.3.0-6.17) xenial; urgency=low

  [ Tim Gardner ]

  * Release Tracking Bug
    - LP: #1532958

  [ Eric Dumazet ]

  * SAUCE: (noup) net: fix IP early demux races
    - LP: #1526946

  [ Guilherme G. Piccoli ]

  * SAUCE: powerpc/eeh: Validate arch in eeh_add_device_early()
    - LP: #1486180

  [ Hui Wang ]

  * [Config] CONFIG_I2C_DESIGNWARE_BAYTRAIL=y, CONFIG_IOSF_MBI=y
    - LP: #1527096

  [ Jann Horn ]

  * ptrace: being capable wrt a process requires mapped uids/gids
    - LP: #1527374

  [ Serge Hallyn ]

  * SAUCE: add a sysctl to disable unprivileged user namespace unsharing

  [ Tim Gardner ]

  * [Config] CONFIG_ZONE_DEVICE=y for amd64
  * [Config] CONFIG_VIRTIO_BLK=y, CONFIG_VIRTIO_NET=y for s390
    - LP: #1532886

  [ Upstream Kernel Changes ]

  * rhashtable: Fix walker list corruption
    - LP: #1526811
  * rhashtable: Kill harmless RCU warning in rhashtable_walk_init
    - LP: #1526811
  * ovl: fix permission checking for setattr
    - LP: #1528904
    - CVE-2015-8660

 -- Tim Gardner <email address hidden> Thu, 17 Dec 2015 05:34:47 -0700

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.