CVE-2015-1328
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in...
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
- Record
CVE-2015-1328- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
- Record
CVE-2015-1328- Updated
- 2026-11-02
EUVDEUVD-2015-1468 No score
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
- Record
EUVD-2015-1468- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jhgp-x42x-cx6m
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in...
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
- Record
GHSA-jhgp-x42x-cx6m- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1328
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
- Record
UBUNTU-CVE-2015-1328- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-2643-1 No score
linux vulnerability
Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system.
- Record
USN-2643-1- Updated
- 2026-11-02
OSVUSN-2644-1 No score
linux-lts-utopic vulnerability
Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system.
- Record
USN-2644-1- Updated
- 2026-11-02
OSVUSN-2645-1 No score
linux-lts-vivid vulnerability
Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system.
- Record
USN-2645-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linuxUbuntu:14.04:LTS |
before 3.13.0-55.92, plus listed versions 3.11.0-12.193.12.0-1.33.12.0-2.53.12.0-2.73.12.0-3.8 Show 45 moreShow less3.12.0-3.93.12.0-4.103.12.0-4.123.12.0-5.133.12.0-7.153.13.0-1.163.13.0-2.173.13.0-3.183.13.0-4.193.13.0-5.203.13.0-6.233.13.0-7.253.13.0-7.263.13.0-8.273.13.0-8.283.13.0-10.303.13.0-11.313.13.0-12.323.13.0-13.333.13.0-14.343.13.0-15.353.13.0-16.363.13.0-17.373.13.0-18.383.13.0-19.393.13.0-19.403.13.0-20.423.13.0-21.433.13.0-22.443.13.0-23.453.13.0-24.463.13.0-24.473.13.0-27.503.13.0-29.533.13.0-30.543.13.0-30.553.13.0-32.573.13.0-33.583.13.0-34.603.13.0-35.623.13.0-36.633.13.0-37.643.13.0-39.663.13.0-40.693.13.0-41.70 |
3.13.0-55.92 |
linux-lts-utopicUbuntu:14.04:LTS |
before 3.16.0-41.55~14.04.1, plus listed versions 3.16.0-25.33~14.04.23.16.0-26.35~14.04.13.16.0-28.37~14.04.13.16.0-28.38~14.04.13.16.0-29.39~14.04.1 Show 12 moreShow less3.16.0-30.40~14.04.13.16.0-31.41~14.04.13.16.0-31.43~14.04.13.16.0-33.44~14.04.13.16.0-34.45~14.04.13.16.0-34.47~14.04.13.16.0-36.48~14.04.13.16.0-37.49~14.04.13.16.0-37.51~14.04.13.16.0-38.52~14.04.13.16.0-39.53~14.04.13.16.0-40.54~14.04.1 |
3.16.0-41.55~14.04.1 |
linux-lts-vividUbuntu:14.04:LTS |
before 3.19.0-21.21~14.04.1, plus listed versions 3.19.0-18.18~14.04.13.19.0-20.20~14.04.1 |
3.19.0-21.21~14.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation | 2015-06-16 |
| Exploit-DB | Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation (Access /etc/shadow) | 2015-06-16 |
| Exploit-DB | Linux Kernel (Ubuntu / Fedora / RedHat) - 'Overlayfs' Local Privilege Escalation (Metasploit) | 2016-11-02 |
| Metasploit | Overlayfs Privilege Escalation | 2015-06-16 |
| PoC in GitHub | 0xf1d0/CVE-2015-1328 | 2025-11-01 |
| PoC in GitHub | BlackFrog-hub/cve-2015-1328 | 2024-07-12 |
| PoC in GitHub | FernandoCassioDev/CVE-2015-1328 | 2026-07-23 |
| PoC in GitHub | SR7-HACKING/LINUX-VULNERABILITY-CVE-2015-1328 | 2020-05-12 |
| PoC in GitHub | WhatsWrongAndWhy/CVE-2015-1328 | 2026-07-15 |
| PoC in GitHub | YastrebX/CVE-2015-1328 | 2024-11-12 |
Show 5 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | bansalkrish007-arch/cve-2015-1328 | 2026-07-24 |
| PoC in GitHub | elit3pwner/CVE-2015-1328-GoldenEye | 2022-02-07 |
| PoC in GitHub | notlikethis/CVE-2015-1328 | 2021-06-26 |
| PoC in GitHub | saqibnet/blackbox-pentesting-infsecos | 2026-05-08 |
| PoC in GitHub | thieveshkar/RootQuest-CTF-Box-Multi-Stage-Exploitation-VM | 2025-10-18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1328 is a high vulnerability (CVSS 7.8) in Linux Kernel, published June 15, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 37.7%, the 98th percentile. Fixed in linux 3.13.0-55.92.
References
people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html
securityfocus.com/bid/75206
exploit-db.com/exploits/37292
security-tracker.debian.org/tracker/CVE-2015-1328
seclists.org/oss-sec/2015/q2/717
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-1328
github.com/advisories/GHSA-jhgp-x42x-cx6m
ubuntu.com/security/CVE-2015-1328
cve.org/CVERecord?id=CVE-2015-1328
Left out here: 16 versions. The JSON record has them.