Description
mount.ecryptfs_private.c in eCryptfs-utils does not validate mount destination filesystem types, which allows local users to gain privileges by mounting over a nonstandard filesystem, as demonstrated by /proc/$pid.
References (11)
Core 11
Core References
Mailing List, Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2016-01/msg00091.html
Broken Link, Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1034791
Mailing List, Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2016-01/msg00118.html
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugs.launchpad.net/ecryptfs/+bug/1530566
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/01/20/6
Mailing List, Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2016-02/msg00004.html
Patch, Third Party Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2876-1
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177396.html
Patch, Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2016/dsa-3450
Patch, Third Party Advisory x_refsource_confirm
https://bazaar.launchpad.net/~ecryptfs/ecryptfs/trunk/revision/870
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177359.html
Scores
CVSS v3
8.4
EPSS
0.0005
EPSS Percentile
16.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-269
Status
published
Products (12)
canonical/ubuntu_linux
12.04
canonical/ubuntu_linux
14.04
canonical/ubuntu_linux
15.04
canonical/ubuntu_linux
15.10
debian/debian_linux
7.0
debian/debian_linux
8.0
ecryptfs/ecryptfs-utils
< 109
fedoraproject/fedora
22
fedoraproject/fedora
23
opensuse/leap
42.1
... and 2 more
Published
Jan 22, 2016
Tracked Since
Feb 18, 2026