CVE-2023-0386

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 6.2

Description A flaw exists in the OverlayFS subsystem of the Linux kernel regarding improper ownership management and access control when processing setuid and setgid attributes. The issue occurs when a user copies a capable file from a nosuid mount into another mount, resulting in a uid mapping bug. This allows a local user to create a file with the SUID flag in directories such as /tmp to escalate privileges to root. The issue is particularly relevant on systems where the FUSE subsystem is installed and unprivileged users are allowed to mount OverlayFS partitions (starting from Linux kernel 5.11 with unprivileged user namespaces enabled). This flaw has been reported as actively exploited in real-world attacks, specifically targeting public-facing servers, cloud platforms, and CI/CD systems.

Recommendations Update the Linux kernel to version 6.2 or later.