The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Mar 31, 2017 | May 2, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade perfUpgrade kernel-debug-develUpgrade python-perfUpgrade kernel-debugUpgrade kernel-toolsUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-tools-libsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel | Dec 4, 2019 | May 2, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade perfUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-libsUpgrade kernelUpgrade python-perfUpgrade kernel-devel | Dec 18, 2019 | May 2, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernel-headersUpgrade kernel-toolsUpgrade kernelUpgrade python-perfUpgrade kernel-tools-libsUpgrade perfUpgrade kernel-devel | Dec 27, 2019 | May 2, 2016 |
| Oracle_linux | — | Upgrade kernel-uek-debug-develUpgrade kernel-uek-firmwareUpgrade kernel-uek-develUpgrade kernel-uekUpgrade kernel-uek-debugUpgrade kernel-uek-doc | Nov 2, 2022 | May 2, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 21, 2014 |
| Suse | — | Upgrade kernel-ec2Upgrade cluster-md-kmp-defaultUpgrade kernel-ec2-develUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-docsUpgrade cluster-network-kmp-defaultUpgrade kernel-obs-buildUpgrade ocfs2-kmp-defaultUpgrade kernel-defaultUpgrade kernel-ec2-extra | Dec 9, 2016 | May 2, 2016 |
| Ubuntu | — | Upgrade linux-image-powerpc-smpUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-1150-raspi2Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-kvmUpgrade linux-image-4.10.0-27-lowlatencyUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-4.4.0-1091-kvmUpgrade linux-image-virtualUpgrade linux-image-4.4.0-208-powerpc-e500mcUpgrade linux-image-4.4.0-208-generic-lpaeUpgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-4.4.0-208-genericUpgrade linux-image-raspi2Upgrade linux-image-powerpc64-embUpgrade linux-image-4.4.0-208-lowlatencyUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-4.4.0-208-powerpc64-smpUpgrade linux-image-4.4.0-1126-awsUpgrade linux-image-4.4.0-1154-snapdragonUpgrade linux-image-generic-lpae-lts-xenialUpgrade linux-image-generic-lpaeUpgrade linux-image-4.10.0-27-genericUpgrade linux-image-4.10.0-27-generic-lpaeUpgrade linux-image-powerpc64-smpUpgrade linux-image-4.4.0-208-powerpc64-embUpgrade linux-image-4.4.0-1090-awsUpgrade linux-image-powerpc-e500mcUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-snapdragonUpgrade linux-image-awsUpgrade linux-image-4.4.0-208-powerpc-smpUpgrade linux-image-generic-lts-xenialUpgrade linux-image-generic | Jul 21, 2017 | May 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub