NVD

Id
24880  
Name
CVE-2015-2925  
Description
The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2015-11-16  
Modified Date
2016-12-07  
Seq
2015-2925  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
131227 24880 CVE-2015-2925 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=397d425dc26da728396e66d392d5dcb8dac30c37  View
131228 24880 CVE-2015-2925 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cde93be45a8a90d8c264c776fab63487b5038a65  View
131229 24880 CVE-2015-2925 SUSE-SU-2015:2194  View
131230 24880 CVE-2015-2925 SUSE-SU-2015:2292  View
131231 24880 CVE-2015-2925 SUSE-SU-2016:0335  View
131232 24880 CVE-2015-2925 SUSE-SU-2016:0337  View
131233 24880 CVE-2015-2925 SUSE-SU-2016:0380  View
131234 24880 CVE-2015-2925 SUSE-SU-2016:0381  View
131235 24880 CVE-2015-2925 SUSE-SU-2016:0383  View
131236 24880 CVE-2015-2925 SUSE-SU-2016:0384  View
131237 24880 CVE-2015-2925 SUSE-SU-2016:0386  View
131238 24880 CVE-2015-2925 SUSE-SU-2016:0387  View
131239 24880 CVE-2015-2925 SUSE-SU-2016:0434  View
131240 24880 CVE-2015-2925 [containers] 20150403 [PATCH review 17/19] vfs: Test for and handle paths that are unreachable from their mnt_root  View
131241 24880 CVE-2015-2925 [containers] 20150403 [PATCH review 19/19] vfs: Do not allow escaping from bind mounts.  View
131242 24880 CVE-2015-2925 http://pkgs.fedoraproject.org/cgit/kernel.git/commit/?h=f22&id=520b64102de2f184036024b2a53de2b67463bd78  View
131243 24880 CVE-2015-2925 RHSA-2015:2636  View
131244 24880 CVE-2015-2925 DSA-3372  View
131245 24880 CVE-2015-2925 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.4  View
131246 24880 CVE-2015-2925 [oss-security] 20150404 Re: Linux namespaces: It is possible to escape from bind mounts  View
131247 24880 CVE-2015-2925 http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html  View
131248 24880 CVE-2015-2925 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html  View
131249 24880 CVE-2015-2925 73926  View
131250 24880 CVE-2015-2925 USN-2792-1  View
131251 24880 CVE-2015-2925 USN-2794-1  View
131252 24880 CVE-2015-2925 USN-2795-1  View
131253 24880 CVE-2015-2925 USN-2798-1  View
131254 24880 CVE-2015-2925 USN-2799-1  View
131255 24880 CVE-2015-2925 https://bugzilla.redhat.com/show_bug.cgi?id=1209367  View
131256 24880 CVE-2015-2925 https://bugzilla.redhat.com/show_bug.cgi?id=1209373  View
131257 24880 CVE-2015-2925 https://github.com/torvalds/linux/commit/397d425dc26da728396e66d392d5dcb8dac30c37  View
131258 24880 CVE-2015-2925 https://github.com/torvalds/linux/commit/cde93be45a8a90d8c264c776fab63487b5038a65  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
10611 JVNDB-2015-005931 Linux Kernel の fs/dcache.c 内の prepend_path 関数におけるコンテナ保護メカニズムを回避される脆弱性 Linux Kernel の fs/dcache.c 内の prepend_path 関数は、bind マウント内部のリネームアクションを適切に処理しないため、コンテナ保護メカニズムを回避される脆弱性が存在します。 CVE-2015-2925 80150 CVE-2015-2925 24880 6.9 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-005931.html 2015-10-22 2015-11-17 View