CVE-2023-32629

Published: 6 June 2023

Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu kernels

From the Ubuntu Security Team

Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux kernel did not properly perform permission checks in certain situations. A local attacker could possibly use this to gain elevated privileges.

Notes

CWE-863
reported by Shir Tamari and Sagi Tzadik from Wiz Research

Mitigation

If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
  sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
  echo kernel.unprivileged_userns_clone=0 | \
  sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Status

Severity score breakdown

References

• https://wiz.io/blog/ubuntu-overlayfs-vulnerability
• https://lists.ubuntu.com/archives/kernel-team/2023-July/140920.html
• https://ubuntu.com/security/notices/USN-6248-1
• https://ubuntu.com/security/notices/USN-6250-1
• https://ubuntu.com/security/notices/USN-6251-1
• https://ubuntu.com/security/notices/USN-6260-1
• https://ubuntu.com/security/notices/USN-6261-1
• https://ubuntu.com/security/notices/USN-6285-1
• https://www.cve.org/CVERecord?id=CVE-2023-32629
• NVD
• Launchpad
• Debian