CVE-2015-1328 | Vulnerability Database | Aqua Security

The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.

Affected Software

Name	Vendor	Start Version	End Version
Ubuntu_linux	Canonical	*	15.04 (including)
Linux	Ubuntu	esm-infra-legacy/trusty	*
Linux	Ubuntu	trusty	*
Linux	Ubuntu	trusty/esm	*
Linux	Ubuntu	utopic	*
Linux	Ubuntu	vivid	*
Linux	Ubuntu	vivid/ubuntu-core	*
Linux-flo	Ubuntu	trusty	*
Linux-goldfish	Ubuntu	trusty	*
Linux-grouper	Ubuntu	trusty	*
Linux-grouper	Ubuntu	utopic	*
Linux-linaro-omap	Ubuntu	precise	*
Linux-linaro-shared	Ubuntu	precise	*
Linux-linaro-vexpress	Ubuntu	precise	*
Linux-lts-raring	Ubuntu	precise	*
Linux-lts-trusty	Ubuntu	precise	*
Linux-lts-utopic	Ubuntu	trusty	*
Linux-lts-vivid	Ubuntu	trusty	*
Linux-maguro	Ubuntu	trusty	*
Linux-mako	Ubuntu	trusty	*
Linux-manta	Ubuntu	trusty	*
Linux-qcm-msm	Ubuntu	precise	*

References

http://seclists.org/oss-sec/2015/q2/717
http://www.exploit-db.com/exploits/40688/
http://www.securityfocus.com/bid/75206
https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html
https://security-tracker.debian.org/tracker/CVE-2015-1328
https://www.exploit-db.com/exploits/37292/
http://seclists.org/oss-sec/2015/q2/717
http://www.exploit-db.com/exploits/40688/
http://www.securityfocus.com/bid/75206
https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html
https://security-tracker.debian.org/tracker/CVE-2015-1328
https://www.exploit-db.com/exploits/37292/

NVD	https://nvd.nist.gov/vuln/detail/CVE-2015-1328
CWE	https://cwe.mitre.org/data/definitions/264.html