On Ubuntu Wily it is possible to place an USERNS overlayfs mount over a fuse mount. The fuse filesystem may contain SUID binaries, but those cannot be executed due to nosuid mount options. But when touching such an SUID binary via overlayfs mount, this will trigger copy_up including all file attributes, thus creating a real SUID binary on the disk.
Sequence:
* Mount fuse filesystem exposing one world writable SUID binary
* Create USERNS
* Mount overlayfs on top of fuse
* open the SUID binary RDWR in overlayfs, thus triggering copy_up
Afterwards the SUID binary can be invoked to gain root privileges.
On Ubuntu Wily it is possible to place an USERNS overlayfs mount over a fuse mount. The fuse filesystem may contain SUID binaries, but those cannot be executed due to nosuid mount options. But when touching such an SUID binary via overlayfs mount, this will trigger copy_up including all file attributes, thus creating a real SUID binary on the disk.
Sequence:
* Mount fuse filesystem exposing one world writable SUID binary
* Create USERNS
* Mount overlayfs on top of fuse
* open the SUID binary RDWR in overlayfs, thus triggering copy_up
Afterwards the SUID binary can be invoked to gain root privileges.
$ lsb_release -rd
Description: Ubuntu 15.10
Release: 15.10
$ apt-cache policy linux-image- 4.2.0-23- generic 4.2.0-23- generic: archive. ubuntu. com/ubuntu/ wily-updates/main amd64 Packages archive. ubuntu. com/ubuntu/ wily-security/main amd64 Packages dpkg/status
linux-image-
Installed: 4.2.0-23.28
Candidate: 4.2.0-23.28
Version table:
*** 4.2.0-23.28 0
500 http://
500 http://
100 /var/lib/