Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 18 Oct 2021 17:52:51 +0000
From: halfdog <>
To: Alon Zahavi <>
Subject: Re: CVE-2021-3847: OverlayFS - Potential Privilege Escalation using overlays copy_up

Alon Zahavi writes:
> After disclosing the issue with the linux-distros mailing list,
> I am reporting the security issue publicly to here. There is
> no patch available and may not be available for a long time
> because the kernel can't enforce the mitigation proposed, as
> that would be a layering violation and could also possibly
> cause a regression. This vulnerability was attached with
> CVE-2021-3847. Here is the report that was initially sent:
> ...

Just funny, just hours before this mail I got 3 mails on different
overlayfs copy-up vuln, e.g.

The Precise Pangolin has reached end of life, so this bug will not be
fixed for that release

** Changed in: linux (Ubuntu Precise)
       Status: New => Won't Fix

You received this bug notification because you are subscribed to the bug

[Bug 1534961] Re: CVE-2016-1575
[Bug 1547400] Re: CVE-2016-2853
[Bug 1535150] Re: CVE-2016-1576

So it is 5 years and not so much changed :-)

Overlayfs and alike where lower privileged user can simultaneously
access lower/upper AND the mounted file system is extremely dangerous
and prone to so many vulns, that nobody should use/allow that.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.