CVE-2015-4176

Published: May 2, 2016Modified: May 6, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

fs/namespace.c in the Linux kernel before 4.0.2 does not properly support mount connectivity, which allows local users to read arbitrary files by leveraging user-namespace root access for deletion of a file or directory.

Affected (1)

Products: Linux: Linux Kernel

Linux

1 product

Linux Kernel

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Up to 4.0.1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (10)

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e0c9c0afd2fc958ffa34b697972721d81df8a56f

Source: secalert@redhat.com

Vendor Advisory

http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.2

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2015/06/04/5

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1249442

Source: secalert@redhat.com

https://github.com/torvalds/linux/commit/e0c9c0afd2fc958ffa34b697972721d81df8a56f

Source: secalert@redhat.com

Vendor Advisory

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e0c9c0afd2fc958ffa34b697972721d81df8a56f