VDB

GSD-2021-3493

GSD-2021-3493 PUBLISHED CVSS 8.800000190734863 HIGH

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

Risk Scores

CVSS v3.1
8.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersions
Ubuntulinux kernel5.8 kernel, 5.4 kernel, 4.15 kernel

Timeline

  • Nov 2, 2020 CVE Published
  • Dec 2, 2021 PoC Published
  • Jun 14, 2023 PoC Published
  • Mar 1, 2024 PoC Published
  • Mar 1, 2024 PoC Published
  • Apr 23, 2024 PoC Published
  • May 19, 2024 PoC Published
  • Jul 17, 2024 PoC Published
  • Sep 6, 2024 PoC Published
  • Dec 24, 2024 PoC Published
  • Feb 6, 2025 PoC Published
  • Feb 23, 2025 PoC Published

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›