cyfenced.com →

[ CVE-2021-3493 · Published 17 Apr 2021 ]

Linux Kernel Privilege Escalation Vulnerability

Exploited · CISA KEV CVSS 7.8 EPSS 49%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-10-20
  • EPSS: 49% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

CISA: The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 10 Nov 2022): Apply updates per vendor instructions.

[ References ]References