CVE-2015-1350

What it actually does

The VFS subsystem in the Linux kernel provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, allowing local users to cause denial of service via capability stripping through a failed system call such as chown on binaries like ping or dumpcap.

Why it matters to the business

Local users can disrupt network diagnostic and capture tools on affected systems, leading to operational interruptions for services relying on those capabilities without requiring network access or elevated privileges.

How an attack unfolds

A local attacker identifies a capability-equipped binary, invokes a system call such as chown that triggers a failed setattr operation, and exploits the underspecified handling to strip extended privileges, resulting in denial of service for the affected program.

How to fix it

Upgrade the xen package on Alpine v3.10 to version 4.9.0-r0 or later to address the incomplete setattr handling in the VFS subsystem.

How to confirm the fix worked

Confirm the installed xen package version meets or exceeds 4.9.0-r0, then verify that capability attributes remain intact after failed setattr operations on test binaries.

Typical attack path

1. Gain local user access on the target system
2. Locate binaries with extended capabilities such as ping or dumpcap
3. Execute a failed chown or similar setattr invocation
4. Confirm capability stripping and resulting service disruption

How to detect it

Review system logs for patterns of failed chown or setattr calls targeting capability-bearing binaries and audit changes to extended file attributes.

What your security team should do

• Apply the xen 4.9.0-r0 update across all Alpine v3.10 deployments
• Audit local user access and capability usage on privileged binaries
• Monitor system call logs for repeated failed setattr attempts on executables