CVE-2016-1576 json
The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to…
published 2016-05-02 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-2671
- cvss
- 7.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 1
- Exploit-DB
Summary
The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.
Patch / fix
- linux Debian 14, Debian 13, Debian 12 4.5.1-1
debian advisories DEBIAN-CVE-2016-1576
- linux Ubuntu 14.04 LTS 3.13.0-79.123
- linux-lts-wily Ubuntu 14.04 LTS 4.2.0-30.35~14.04.1
- linux-lts-vivid Ubuntu 14.04 LTS 3.19.0-51.57~14.04.1
- linux-lts-utopic Ubuntu 14.04 LTS 3.16.0-62.82~14.04.1
ubuntu advisories UBUNTU-CVE-2016-1576
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Timeline
- Published
- First public exploit (EDB-41763)
Exploit prediction
1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-41763 Ubuntu 15.10 - 'USERNS ' Overlayfs Over Fuse Privilege Escalation local, 2016-11-22
- halfdog.net http://www.halfdog.net/Security/2016/OverlayfsOverFusePrivilegeEscalation/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Technology feeds
References
-
git.kernel.org
/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79360
mailing-list, patch, vendor-advisory
-
launchpadlibrarian.net
/235300093/0005-overlayfs-Be-more-careful-about-copying-up-sxid-file.patch
mailing-list, patch, third-party-advisory
-
launchpadlibrarian.net
/235300225/0006-overlayfs-Propogate-nosuid-from-lower-and-upper-moun.patch
mailing-list, patch, third-party-advisory
-
halfdog.net
/Security/2016/OverlayfsOverFusePrivilegeEscalation/
exploit, third-party-advisory
-
bugs.launchpad.net
/bugs/1535150
third-party-advisory
-
openwall.com
/lists/oss-security/2016/02/24/8
mailing-list, third-party-advisory
-
people.canonical.com
/~ubuntu-security/cve/2016/CVE-2016-1576.html
third-party-advisory
-
openwall.com
/lists/oss-security/2021/10/18/1
mailing-list, third-party-advisory
Sources
- CVE List CVE-2016-1576
- NVD CVE-2016-1576
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.