CVE-2014-5206

What it actually does

The do_remount function fails to preserve the MNT_LOCK_READONLY flag during remount operations on bind mounts inside user namespaces, allowing a local process to clear the read-only restriction.

Why it matters to the business

Unpatched systems permit local accounts to modify files or directories that administrators intended to keep read-only, weakening container and sandbox isolation and increasing the chance of unauthorized data changes or further privilege escalation on any affected Linux host.

How an attack unfolds

An attacker with a local shell creates a user namespace, binds a directory as read-only, then issues a mount remount command that clears the lock bit, restoring write access and defeating the intended protection.

How to fix it

Upgrade the Linux kernel to a version later than 3.16.1 that restores MNT_LOCK_READONLY handling across remounts of bind mounts; apply vendor backports for supported distributions and reboot affected hosts.

How to confirm the fix worked

Confirm the running kernel version exceeds 3.16.1, review the do_remount implementation for retention of the MNT_LOCK_READONLY flag, and test that remount attempts inside user namespaces preserve read-only semantics.

Typical attack path

1. Obtain a local shell on the target system
2. Enter a new user namespace via unshare or clone
3. Create a bind mount marked read-only
4. Execute mount -o remount,rw on the bind mount
5. Write to previously protected paths or escape the sandbox

How to detect it

Review system audit logs and mount command history for repeated remount operations originating from user-namespace processes; examine kernel logs for namespace-related mount activity around the time of suspected access.

What your security team should do

• Inventory all Linux systems and identify those still running kernels 3.16.1 or earlier
• Prioritize patching of internet-facing or multi-tenant hosts that allow unprivileged user namespaces
• Disable unprivileged user namespaces via kernel parameter where the feature is unnecessary
• Monitor for future kernel updates and schedule maintenance windows before the next disclosure wave