CVE-2023-3776

Note

Priority reason:
By using unprivileged user namespaces, this can be exploited to achieve local privilege escalation.
If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
  sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
  echo kernel.unprivileged_userns_clone=0 | \
  sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Parameter	Value
Base score	7.8
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2023-3776

From the Ubuntu Security Team

Notes

Mitigation

Priority

Cvss 3 Severity Score

Status

Severity score breakdown

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Further reading

Package	Release	Status
linux Launchpad, Ubuntu, Debian	bionic	Released (4.15.0-216.227) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	focal	Released (5.4.0-159.176)
	jammy	Released (5.15.0-82.91)
	kinetic	Ignored (end of life, was needs-triage)
	lunar	Released (6.2.0-31.31)
	mantic	Not vulnerable (6.5.0-5.5)
	noble	Pending
	trusty	Released (3.13.0-193.244) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	upstream	Released (6.5~rc2)
	xenial	Released (4.4.0-244.278) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	Patches: Introduced by 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Fixed by 0323bce598eea038714f941ce2b22541c46d488f
linux-allwinner Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Ignored (end of life, was needs-triage)
	lunar	Ignored (end of kernel support, was needs-triage)
	mantic	Does not exist
	noble	Does not exist
	trusty	Does not exist
	upstream	Released (6.5~rc2)
	xenial	Does not exist
linux-allwinner-5.19 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Ignored (end of kernel support, was needed)
	kinetic	Does not exist
	lunar	Does not exist
	mantic	Does not exist
	noble	Does not exist
	trusty	Does not exist
	upstream	Released (6.5~rc2)
	xenial	Does not exist
linux-aws Launchpad, Ubuntu, Debian	bionic	Released (4.15.0-1160.173) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	focal	Released (5.4.0-1108.116)
	jammy	Released (5.15.0-1043.48)
	kinetic	Ignored (end of life, was needs-triage)
	lunar	Released (6.2.0-1010.10)
	mantic	Not vulnerable (6.5.0-1005.5)
	noble	Pending
	trusty	Released (4.4.0-1122.128) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	upstream	Released (6.5~rc2)