The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
Solution:
Workaround:
The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
| Link | Tags |
|---|---|
| https://ubuntu.com/security/notices/USN-4917-1 | vendor advisory |
| https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52 | patch mailing list third party advisory |
| https://www.openwall.com/lists/oss-security/2021/04/16/1 | third party advisory mailing list |
| http://packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.html | third party advisory vdb entry exploit |
| http://packetstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.html | third party advisory vdb entry |
| http://packetstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.html | third party advisory vdb entry exploit |