CVE-2023-0386

Published Mar 22, 2023

Last updated a month ago

Linux Kernel

Overview

AI description

Automated description summarized from trusted sources.

CVE-2023-0386 is a flaw found in the Linux kernel's OverlayFS subsystem. It involves unauthorized access to the execution of a setuid file with capabilities. Specifically, the vulnerability lies in how a user copies a capable file from a nosuid mount into another mount. This "uid mapping bug" allows a local user to escalate their privileges on the system. The kernel fails to check if the user/group owning a file copied from the overlay file system to the 'upper' directory is mapped in the current user namespace. This can be exploited to create a SUID binary owned by root, allowing an unprivileged user to gain elevated privileges.

Description: A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
Source: secalert@redhat.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Linux Kernel Improper Ownership Management Vulnerability
Exploit added on: Jun 17, 2025
Exploit action due: Jul 8, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

secalert@redhat.com: CWE-282
nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6770B6C3-732E-4E22-BF1C-2D2FD610061C"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "9F9C8C20-42EB-4AB5-BD97-212DEB070C43"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7FFF7106-ED78-49BA-9EC5-B889E3685D53"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "E63D8B0F-006E-4801-BF9D-1C001BBFB4F9"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "56409CEC-5A1E-4450-AA42-641E459CC2AF"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "B06F4839-D16A-4A61-9BB5-55B13F41E47F"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D0B4AD8A-F172-4558-AEC6-FF424BA2D912"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "8497A4C9-8474-4A62-8331-3FE862ED4098"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "234DEFE0-5CE5-4B0A-96B8-5D227CB8ED31"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "CDDF61B7-EC5C-467C-B710-B89F502CD04F"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB"
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "359012F1-2C63-415A-88B8-6726A87830DE"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "91C2E92D-CC25-4FBD-8824-56A148119D7E",
            "versionEndExcluding": "5.15.91",
            "versionStartIncluding": "5.11"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ED5B6045-B1D2-4E03-B194-9005A351BCAE",
            "versionEndExcluding": "6.1.9",
            "versionStartIncluding": "5.16"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A127C155-689C-4F67-B146-44A57F4BFD85"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D34127CC-68F5-4703-A5F6-5006F803E4AE"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.