The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Mar 31, 2017 | May 2, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-debugUpgrade kernel-tools-libsUpgrade perfUpgrade kernel-debug-develUpgrade python-perfUpgrade kernel-debuginfoUpgrade kernel-toolsUpgrade kernel-headers | Dec 4, 2019 | May 2, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade kernel-debuginfoUpgrade kernel-headersUpgrade perfUpgrade python-perfUpgrade kernel-tools-libsUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-develUpgrade kernel-tools | Dec 18, 2019 | May 2, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernel-tools-libsUpgrade perfUpgrade kernel-develUpgrade kernel-toolsUpgrade kernelUpgrade python-perfUpgrade kernel-headers | Dec 27, 2019 | May 2, 2016 |
| Oracle_linux | — | Upgrade kernel-uek-docUpgrade kernel-uek-debugUpgrade kernel-uek-develUpgrade kernel-uek-debug-develUpgrade kernel-uek-firmwareUpgrade kernel-uek | Nov 2, 2022 | May 2, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 21, 2014 |
| Suse | — | Upgrade dlm-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-docsUpgrade kernel-ec2Upgrade cluster-md-kmp-defaultUpgrade kernel-ec2-develUpgrade ocfs2-kmp-defaultUpgrade kernel-ec2-extraUpgrade kernel-defaultUpgrade cluster-network-kmp-defaultUpgrade kernel-obs-build | Dec 9, 2016 | May 2, 2016 |
| Ubuntu | — | Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.10.0-27-genericUpgrade linux-image-4.4.0-1126-awsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-4.4.0-208-powerpc-e500mcUpgrade linux-image-powerpc64-embUpgrade linux-image-powerpc-smpUpgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-1150-raspi2Upgrade linux-image-4.4.0-208-powerpc64-smpUpgrade linux-image-4.4.0-208-lowlatencyUpgrade linux-image-4.4.0-208-genericUpgrade linux-image-raspi2Upgrade linux-image-4.4.0-1091-kvmUpgrade linux-image-generic-lpae-lts-xenialUpgrade linux-image-4.4.0-208-generic-lpaeUpgrade linux-image-generic-lpaeUpgrade linux-image-4.4.0-1154-snapdragonUpgrade linux-image-4.10.0-27-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-virtualUpgrade linux-image-genericUpgrade linux-image-powerpc-e500mcUpgrade linux-image-awsUpgrade linux-image-powerpc64-smpUpgrade linux-image-4.4.0-1090-awsUpgrade linux-image-4.4.0-208-powerpc-smpUpgrade linux-image-4.4.0-208-powerpc64-embUpgrade linux-image-4.10.0-27-generic-lpaeUpgrade linux-image-generic-lts-xenialUpgrade linux-image-snapdragonUpgrade linux-image-lowlatency-hwe-16.04 | Jul 21, 2017 | May 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub