CVE-2015-8660

What it actually does

The ovl_setattr function merges distinct setattr operations, allowing a local attacker with sufficient privileges to bypass intended access controls and alter attributes on arbitrary overlay filesystem files.

Why it matters to the business

Local attackers can escalate privileges or tamper with protected files on affected Linux systems, increasing risk of full host compromise and data integrity loss; the issue has been publicly weaponized for years.

How an attack unfolds

An attacker with local access on a system using overlayfs crafts a program that triggers the flawed setattr merging logic in the kernel, bypassing permission checks to modify file attributes outside the intended overlay scope.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the setattr merge logic (post-4.3.3); apply the latest stable kernel package for the distribution and reboot.

How to confirm the fix worked

Confirm kernel version is newer than 4.3.3 and that the overlayfs setattr code no longer merges operations across distinct files; test with a reproducer that previously succeeded.

Typical attack path

1. Obtain local shell or code execution on target Linux host
2. Identify presence of overlayfs mounts
3. Execute crafted application that invokes ovl_setattr with conflicting operations
4. Bypass access restrictions and modify attributes on target files
5. Leverage modified attributes to escalate privileges or access restricted data

How to detect it

Review kernel audit logs and syslog for unusual overlayfs setattr calls or attribute modification attempts on overlay mounts; correlate with process creation events from untrusted users.

What your security team should do

• Prioritize kernel upgrades on all systems using overlayfs
• Restrict local unprivileged access where possible until patched
• Monitor for new kernel releases containing the overlayfs fix
• Review systems for overlayfs usage and schedule maintenance windows