CVE-2023-2640

Published: 6 June 2023

On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.

From the Ubuntu Security Team

Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux kernel did not properly perform permission checks in certain situations. A local attacker could possibly use this to gain elevated privileges.

Notes

initially reported as ZDI-CAN-20913 by Stonejiajia
later reported by Shir Tamari and Sagi Tzadik from Wiz Research
CWE-863

Mitigation

If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
  sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
  echo kernel.unprivileged_userns_clone=0 | \
  sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Status

Severity score breakdown

References

• https://wiz.io/blog/ubuntu-overlayfs-vulnerability
• https://lists.ubuntu.com/archives/kernel-team/2023-July/140923.html
• https://ubuntu.com/security/notices/USN-6248-1
• https://ubuntu.com/security/notices/USN-6250-1
• https://ubuntu.com/security/notices/USN-6260-1
• https://ubuntu.com/security/notices/USN-6285-1
• https://www.cve.org/CVERecord?id=CVE-2023-2640
• NVD
• Launchpad
• Debian