Local Privilege Escalation in nginx Error Log Handling

Successful exploitation allows a local attacker with access to the nginx worker or web server account to escalate privileges to root. The vulnerability does not by itself provide initial access, but it can convert a compromise of the low-privileged web server context into full system compromise.

Restrict access to the web server user account and prevent untrusted local users or post-exploitation code from operating in that security context. Harden file-system permissions around log directories and monitor for unexpected symbolic links involving nginx log files. Where possible, use mandatory access controls or service confinement to limit the ability of the nginx account to prepare symlink targets for privileged processes. The primary mitigation is to install the patched package.

Upgrade nginx to a fixed package version. Reported fixed versions include Debian jessie nginx before 1.6.2-5+deb8u3, Ubuntu 14.04 LTS before 1.4.6-1ubuntu3.6, Ubuntu 16.04 LTS before 1.10.0-0ubuntu0.16.04.3, Ubuntu 16.10 before 1.10.1-0ubuntu1.1, and Gentoo nginx ebuild before 1.10.2-r3. Apply the vendor-distributed package updates for the affected platform.