Description
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux | 3.13.0-55.92 | USN-2643-1 |
| Ubuntu 14.04 LTS | linux-lts-utopic | 3.16.0-41.55~14.04.1 | USN-2644-1 |
| Ubuntu 14.04 LTS | linux-lts-vivid | 3.19.0-21.21~14.04.1 | USN-2645-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Overlayfs Privilege Escalation
exploit/linux/local/overlayfs_priv_esc
Exploit-DB 3
- Linux Kernel (Ubuntu / Fedora / RedHat) - 'Overlayfs' Local Privilege Escalation (Metasploit) EDB-40688 · local · Nov 2, 2016 · verified
- Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation EDB-37292 · local · Jun 16, 2015 · verified
- Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation (Access /etc/shadow) EDB-37293 · local · Jun 16, 2015 · verified
GitHub 11 repositories · most starred shown
-
elit3pwner/CVE-2015-1328-GoldenEye ★ 10 · Feb 7, 2022
kernel exploit
-
0xf1d0/CVE-2015-1328 ★ 1 · Nov 1, 2025
A Proof of Concept (PoC) exploit for CVE-2015-1328
-
FernandoCassioDev/CVE-2015-1328 ★ 0 · Jul 23, 2026
-
WhatsWrongAndWhy/CVE-2015-1328 ★ 0 · Jul 15, 2026
-
saqibnet/blackbox-pentesting-infsecos ★ 0 · May 8, 2026
Full black-box penetration test against SecOS:1 (VulnHub) — CSRF exploitation, privilege escalation via CVE-2015-1328 (OverlayFS), post-exploitation
-
thieveshkar/RootQuest-CTF-Box-Multi-Stage-Exploitation-VM ★ 0 · Oct 18, 2025
Custom vulnerable VM (Ubuntu 14.04) designed for teaching multi-stage penetration testing. Features 10 interconnected challenges across Forensics, Web Exploitation (SQLi, XSS), Cryptography, and Kern…
-
YastrebX/CVE-2015-1328 ★ 0 · Nov 12, 2024
CVE: 2015-1328 On python test
-
BlackFrog-hub/cve-2015-1328 ★ 0 · Jul 12, 2024
-
notlikethis/CVE-2015-1328 ★ 0 · Jun 26, 2021
compiled CVE-2015-1328
-
SR7-HACKING/LINUX-VULNERABILITY-CVE-2015-1328 ★ 0 · May 12, 2020
This is my SNP project where my ID is IT19366128
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- USN-2643-1 linux vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-2644-1 linux-lts-utopic vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-2645-1 linux-lts-vivid vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026