CVE-2023-0386:

Privilege Escalation Vulnerability in Linux Kernel's OverlayFS Subsystem (CVE-2023-0386)

Score
A numerical rating that indicates how dangerous this vulnerability is.

7.8High

Published Date:Mar 22, 2023
CISA KEV Date:Jun 17, 2025
Industries Affected:20

Armis Early Warning:

818 Days

Threat Predictions

EPSS Score:52.4
EPSS Percentile:98%

Exploitability

Score:1.8
Attack Vector:LOCAL
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Privilege Escalation Vulnerability in Linux Kernel's OverlayFS Subsystem (CVE-2023-0386)

Overview

The vulnerability exists in the OverlayFS subsystem of the Linux kernel. OverlayFS is a type of union filesystem that allows overlaying one filesystem on top of another. The specific issue involves how the kernel handles the copying of files with capabilities from nosuid mounts to other mounts. When a user copies a capable file from a nosuid mount to another mount, the uid mapping is incorrectly handled, allowing the preservation of capabilities that should be dropped. This improper permission management (CWE-282) enables local users to execute setuid files with elevated privileges, effectively bypassing security restrictions intended to prevent privilege escalation.

Remediation

To mitigate this vulnerability, system administrators should:
1. Update the Linux kernel to a patched version. The fix has been committed to the mainline Linux kernel (commit 4f11ada10d0a).
2. For specific distributions:
Debian users should apply the security updates referenced in DSA-5402 for standard Debian or DLA 3446-1/DLA 3840-1 for Debian LTS.
Other Linux distributions should apply their respective vendor-provided security patches.
3. If immediate patching is not possible, consider implementing additional access controls to restrict local user access to sensitive file systems and monitor for suspicious file operations involving setuid files.
4. After patching, restart the system to ensure the updated kernel is in use.