The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities
Affects Ubuntu kernels in the 4.4, 4.15, 5.4 and 5.8 series; upstream Linux is not affected. Fixed in 4.4.0-209.241, 4.15.0-142.146, 5.4.0-72.80 and 5.8.0-50.56.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 5.8.0-50.56, 5.4.0-72.80, 4.15.0-142.146, 4.4.0-209.241
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's overlayfs implementation is affected, particularly on Ubuntu systems where unprivileged overlay mounts were enabled alongside unprivileged user namespaces. A local attacker could exploit this flaw to gain elevated privileges on the affected system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Ubuntu linux kernel
From 5.8 kernel · fixed in 5.8.0-50.56; From 5.4 kernel · fixed in 5.4.0-72.80; From 4.15 kernel · fixed in 4.15.0-142.146; From 4.4 kernel · fixed in 4.4.0-209.241
References 6
ubuntu.com
git.kernel.org
openwall.com
Questions about CVE-2021-3493
What does this mean?
The overlayfs code in the Linux kernel did not properly check file capability settings against user namespaces. The advisory says a local attacker could use this to gain elevated privileges.Source: openwall.com, ubuntu.com
Am I affected, and how do I check?
The listed affected builds are Ubuntu kernels in the 4.4, 4.15, 5.4 and 5.8 series before the fixed builds. The advisory ties the issue to Ubuntu's patch for unprivileged overlayfs mounts and to unprivileged user namespaces, which Ubuntu enables by default. To check a system, run uname -r and compare the build number with the fixed versions.Source: openwall.com, ubuntu.com
What should I do about it?
Update to the fixed Ubuntu kernel for the relevant series: 4.4.0-209.241, 4.15.0-142.146, 5.4.0-72.80 or 5.8.0-50.56 or later.Source: openwall.com, ubuntu.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-10-20, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data