CVE-2015-2925

Published: Nov 16, 2015Modified: May 6, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."

Affected (14)

Products: Linux: Linux Kernel · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Before 3.2.72
Linux Linux Kernel	From 3.11 to 3.12.49
Linux Linux Kernel	From 3.13 to 3.14.55
Linux Linux Kernel	From 3.15 to 3.16.35
Linux Linux Kernel	From 3.17 to 3.18.23
Linux Linux Kernel	From 3.19 to 4.1.11
Linux Linux Kernel	From 3.3 to 3.4.110
Linux Linux Kernel	From 3.5 to 3.10.91
Linux Linux Kernel	From 4.2 to 4.2.4

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.04

References (68)

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=397d425dc26da728396e66d392d5dcb8dac30c37

Source: cve@mitre.org

Third Party Advisory

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cde93be45a8a90d8c264c776fab63487b5038a65

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00007.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00009.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00017.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00018.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00019.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00020.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00021.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00022.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00034.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://permalink.gmane.org/gmane.linux.kernel.containers/29173

Source: cve@mitre.org

Broken Link

http://permalink.gmane.org/gmane.linux.kernel.containers/29177

Source: cve@mitre.org

Broken Link

http://pkgs.fedoraproject.org/cgit/kernel.git/commit/?h=f22&id=520b64102de2f184036024b2a53de2b67463bd78

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-2636.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0068.html

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2015/dsa-3364

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2015/dsa-3372

Source: cve@mitre.org

Third Party Advisory

http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.4

Source: cve@mitre.org

Vendor Advisory

http://www.openwall.com/lists/oss-security/2015/04/04/4

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Source: cve@mitre.org

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/73926

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2792-1

Source: cve@mitre.org

Third Party Advisory

http://www.ubuntu.com/usn/USN-2794-1

Source: cve@mitre.org

Third Party Advisory

http://www.ubuntu.com/usn/USN-2795-1

Source: cve@mitre.org

Third Party Advisory

http://www.ubuntu.com/usn/USN-2798-1

Source: cve@mitre.org

Third Party Advisory

http://www.ubuntu.com/usn/USN-2799-1

Source: cve@mitre.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1209367

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1209373

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://github.com/torvalds/linux/commit/397d425dc26da728396e66d392d5dcb8dac30c37

Source: cve@mitre.org

Third Party Advisory

https://github.com/torvalds/linux/commit/cde93be45a8a90d8c264c776fab63487b5038a65

Source: cve@mitre.org

Third Party Advisory

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=397d425dc26da728396e66d392d5dcb8dac30c37