Ubuntu USN-2317-1: Linux Kernel User Namespace Privilege Escalation Vulnerabilities (CVE-2014-5207/5206)

From this webpage screenshot, the following key information about the vulnerability can be obtained: Announcement Title: USN-2317-1: Linux kernel (Trusty HWE) vulnerabilities Release Date: 18 August 2014 Summary: Fixes multiple security issues in the kernel. Affected Version: 12.04 Details: - Eric W. Biederman discovered a flaw in the Linux kernel's user namespace subsystem related to the mediation of mount flags. An unprivileged user could exploit this flaw to bypass mount restrictions and potentially gain administrative privileges. (CVE-2014-5207) - Kenton Varda discovered a flaw in the handling of read-only bind mounts when using user namespaces. An unprivileged local user could exploit this flaw to gain full write access to mounts that should only be read-only. (CVE-2014-5206) Update Notes: - A system reboot is required for all necessary changes to take effect. - Note: Due to unavoidable ABI changes, a new kernel version number has been assigned. All third-party kernel modules must be recompiled and reinstalled. If you use , you must update that package to ensure module compatibility with the new kernel version. - If you have manually uninstalled standard kernel meta-packages (e.g., , , ), standard system upgrades will automatically handle this. Ubuntu Versions and Package Versions: - : - - References: - CVE-2014-5207 - CVE-2014-5206 Related Notices: - USN-2318-1

Goal Reached Thanks to every supporter — we hit 100%!

Ubuntu USN-2317-1: Linux Kernel User Namespace Privilege Escalation Vulnerabilities (CVE-2014-5207/5206)