UBUNTU-CVE-2015-4177

Description

The collect_mounts function in fs/namespace.c in the Linux kernel before 4.0.5 does not properly consider that it may execute after a path has been unmounted, which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call.

CVSS Metrics

• v3.0•MEDIUM•Score: 5.5CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Systems

• ubuntu•linux

  < 4.2.0-16.19

• ubuntu•linux-aws

  < 4.4.0-1002.2 | < 4.4.0-1001.10

• ubuntu•linux-gke

  < 4.4.0-1003.3

• ubuntu•linux-hwe

  < 4.8.0-36.36~16.04.1

• ubuntu•linux-lts-wily

  < 4.2.0-18.22~14.04.1

• ubuntu•linux-lts-xenial

  < 4.4.0-13.29~14.04.1

• ubuntu•linux-raspi2

  < 4.2.0-1013.19

• ubuntu•linux-snapdragon

  < 4.4.0-1012.12

References (4)

• https://ubuntu.com/security/CVE-2015-4177
• http://www.openwall.com/lists/oss-security/2015/05/29/5
• http://www.openwall.com/lists/oss-security/2015/06/04/9
• https://www.cve.org/CVERecord?id=CVE-2015-4177