The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Mar 31, 2017 | May 2, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade kernelUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-headersUpgrade kernel-debugUpgrade perfUpgrade kernel-debug-develUpgrade python-perfUpgrade kernel-debuginfoUpgrade kernel-tools-libs | Dec 4, 2019 | May 2, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade kernel-debuginfoUpgrade perfUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-develUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-tools-libs | Dec 18, 2019 | May 2, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-perfUpgrade kernel-toolsUpgrade kernel-headersUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-develUpgrade perf | Dec 27, 2019 | May 2, 2016 |
| Oracle_linux | — | Upgrade kernel-uek-debug-develUpgrade kernel-uek-firmwareUpgrade kernel-uek-develUpgrade kernel-uekUpgrade kernel-uek-debugUpgrade kernel-uek-doc | Nov 2, 2022 | May 2, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 21, 2014 |
| Suse | — | Upgrade ocfs2-kmp-defaultUpgrade cluster-network-kmp-defaultUpgrade kernel-ec2-extraUpgrade kernel-obs-buildUpgrade kernel-defaultUpgrade kernel-ec2Upgrade kernel-docsUpgrade gfs2-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kernel-ec2-develUpgrade cluster-md-kmp-default | Dec 9, 2016 | May 2, 2016 |
| Ubuntu | — | Upgrade linux-image-raspi2Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-powerpc64-embUpgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-4.4.0-208-generic-lpaeUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-generic-lpae-lts-xenialUpgrade linux-image-4.4.0-208-genericUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-kvmUpgrade linux-image-4.4.0-1126-awsUpgrade linux-image-4.4.0-1150-raspi2Upgrade linux-image-4.4.0-208-lowlatencyUpgrade linux-image-4.4.0-208-powerpc-e500mcUpgrade linux-image-4.4.0-1154-snapdragonUpgrade linux-image-powerpc-smpUpgrade linux-image-generic-lpaeUpgrade linux-image-4.10.0-27-lowlatencyUpgrade linux-image-virtualUpgrade linux-image-4.4.0-1091-kvmUpgrade linux-image-4.10.0-27-genericUpgrade linux-image-4.4.0-208-powerpc64-smpUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-208-powerpc-smpUpgrade linux-image-powerpc64-smpUpgrade linux-image-snapdragonUpgrade linux-image-awsUpgrade linux-image-generic-lts-xenialUpgrade linux-image-powerpc-e500mcUpgrade linux-image-4.4.0-208-powerpc64-embUpgrade linux-image-4.4.0-1090-awsUpgrade linux-image-genericUpgrade linux-image-4.10.0-27-generic-lpaeUpgrade linux-image-lowlatency-hwe-16.04 | Jul 21, 2017 | May 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub