CVE-2015-1328Linux Kernel Vulnerability
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration…
Published Nov 28, 2016 · Updated Apr 22, 2026 · Also known as UBUNTU-CVE-2015-1328, USN-2643-1, USN-2644-1, USN-2645-1
Key Facts
Patch immediately- CVE-2015-1328 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Ubuntu Linux (Canonical), Linux Kernel, linux (debian) and 2 more products.
- It is exploited in the wild, listed in Industry KEV feed since Aug 19, 2021. Public exploit code is available.
- EPSS estimates a 38% probability of exploitation in the next 30 days.
- Fixed versions are available, including Ubuntu Linux 15.04, linux 3.13.0-55.92, Linux Kernel 3.19.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3.1
7.8
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
38%
Higher than 98.5% of all scored CVEs
Exploit maturity
Weaponized
ATLAS score
61/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Aug 19, 2021
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Weaponized
Public exploit code
5
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
- advisoryhttps://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2015-1328
- advisoryhttps://ubuntu.com/security/CVE-2015-1328
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2015-1328
- advisory[oss-security] 20150616 CVE-2015-1328: incorrect permission checks in overlayfs, ubuntu local root
- advisoryhttps://ubuntu.com/security/notices/USN-2640-1
Description
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Aug 19, 2021 | n/a | Not reported |
Affected Products
10 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Ubuntu LinuxCanonical | See advisory | 15.04 |
| Linux KernelLinux | See advisory | 3.19 |
| linuxdebian | See advisory | 0 |
| linux-lts-utopicubuntu | See advisory | 3.16.0-41.55~14.04.1 |
| linux-lts-vividubuntu | See advisory | 3.19.0-21.21~14.04.1 |
Patched Releases
Ubuntu Linux
15.04
linux
3.13.0-55.92
Linux Kernel
3.19
linux-lts-utopic
3.16.0-41.55~14.04.1
linux-lts-vivid
3.19.0-21.21~14.04.1
Timeline
Publicly disclosed
Nov 28, 2016
Added to Industry KEV feed
Aug 19, 2021
Last updated
Apr 22, 2026
Weakness Type
- CWE-264
References
- advisorypeople.canonical.com · CVE-2015-1328
- advisorysecurity-tracker.debian.org · CVE-2015-1328
- advisoryubuntu.com · CVE-2015-1328
- advisorycve.org · CVERecord
- advisory[oss-security] 20150616 CVE-2015-1328: incorrect permission checks in overlayfs, ubuntu local root
FAQ
Common Questions.
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an ar…
Affected: Ubuntu Linux (Canonical); Linux Kernel; linux (debian), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Aug 19, 2021.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Ubuntu Linux 15.04, linux 3.13.0-55.92, Linux Kernel 3.19.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2015-1328 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo