CVE-2014-5206

Linux Kernel < 3.16.1 - Privilege Escalation via Remount of Bind Mount

Title source: llm
STIX 2.1

Description

The do_remount function in fs/namespace.c in the Linux kernel through 3.16.1 does not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, which allows local users to bypass an intended read-only restriction and defeat certain sandbox protection mechanisms via a "mount -o remount" command within a user namespace.

References (7)

Core 7
Core References
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2318-1
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/69214
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1129662
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/08/13/4
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2317-1

Scores

EPSS 0.0037
EPSS Percentile 28.7%

Details

CWE
CWE-269
Status published
Products (3)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
linux/linux_kernel 3.8 - 3.10.55
Published Aug 18, 2014
Tracked Since Feb 18, 2026