CVE-2021-3493highunder attackCWE-270

CVE-2021-3493: high-severity vulnerability in Ubuntu linux kernel

Published · Updated

Follow this CVE+ Monitor Linux+ Monitor Linux kernel

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 49%
from disclosure to weaponsame day
Published on NVDApr 17
1st PoCMar 30
metasploitApr 12
CISA KEV+551d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
5 products (198 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 5
Action required by CISAfederal deadline: 2022-11-10

Apply updates per vendor instructions.

In short

A flaw in overlayfs (a Linux filesystem layer) allows unprivileged users to gain elevated privileges by manipulating file capabilities. This matters because it breaks the security boundary that normally prevents regular users from becoming administrators.

Technical detail

The overlayfs implementation fails to properly validate file capability settings against user namespace restrictions. Combined with Ubuntu's patch enabling unprivileged overlay mounts, an attacker in an unprivileged user namespace can set capabilities on files to escalate privileges without requiring root access initially.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Ubuntu · linux kernel
public PoCs found — 48
githubgithub.com/briskets/CVE-2021-3493★ 442githubgithub.com/inspiringz/CVE-2021-3493★ 42githubgithub.com/oneoy/CVE-2021-3493★ 3githubgithub.com/fei9747/CVE-2021-3493★ 1githubgithub.com/cerodah/overlayFS-CVE-2021-3493★ 1githubgithub.com/puckiestyle/CVE-2021-3493★ 1githubgithub.com/ptkhai15/OverlayFS---CVE-2021-3493★ 0githubgithub.com/iamz24/CVE-2021-3493_CVE-2022-3357★ 0githubgithub.com/George-Yanni/DeepRoot★ 0githubgithub.com/fathallah17/OverlayFS-CVE-2021-3493★ 0githubgithub.com/iqbalhussainas/OverlayFS-LPE-Exploit★ 0githubgithub.com/Sornphut/OverlayFS---CVE-2021-3493★ 0githubgithub.com/cyberx-1/OverlayFS-CVE-2021-3493★ 0githubgithub.com/Abdennour-py/CVE-2021-3493★ 0githubgithub.com/derek-turing/CVE-2021-3493★ 0githubgithub.com/pmihsan/OverlayFS-CVE-2021-3493★ 0vulncheckvulncheck.com/xdb/586ebe33df5funverifiedvulncheckvulncheck.com/xdb/b1b3a8751d53unverifiedvulncheckvulncheck.com/xdb/ed42677360baunverifiedvulncheckvulncheck.com/xdb/bf6732e3dacaunverifiedvulncheckvulncheck.com/xdb/df20ad5b82e3unverifiedvulncheckvulncheck.com/xdb/f8390219793funverifiedvulncheckvulncheck.com/xdb/93af15d63cbbunverifiedvulncheckvulncheck.com/xdb/9f1aa472b331unverifiedvulncheckvulncheck.com/xdb/cb542684d6e8unverifiedvulncheckvulncheck.com/xdb/c7b918e28754unverifiedvulncheckvulncheck.com/xdb/e11475eed700unverifiedvulncheckvulncheck.com/xdb/cdab85ebdf2eunverifiedvulncheckvulncheck.com/xdb/2741081d8c00unverifiedvulncheckvulncheck.com/xdb/f87c55028b1eunverifiedvulncheckvulncheck.com/xdb/1af99c414b15unverifiedcve_referencepacketstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.htmlunverifiedvulncheckvulncheck.com/xdb/2d195a039b94unverifiedcve_referencepacketstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.htmlunverifiedcve_referencepacketstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.htmlunverifiedvulncheckvulncheck.com/xdb/0143280443efunverifiedvulncheckvulncheck.com/xdb/80b50ee28342unverifiedvulncheckvulncheck.com/xdb/260ad0a548b5unverifiedvulncheckvulncheck.com/xdb/8bc3c24df427unverifiedvulncheckvulncheck.com/xdb/c90d13040f2aunverifiedvulncheckvulncheck.com/xdb/76f421f52f8funverifiedvulncheckvulncheck.com/xdb/44567c4bebd7unverifiedvulncheckvulncheck.com/xdb/f90698fb4173unverifiedvulncheckvulncheck.com/xdb/53855273d7f8unverifiedvulncheckvulncheck.com/xdb/39754c7f28a6unverifiedvulncheckvulncheck.com/xdb/165ca931536bunverifiedvulncheckvulncheck.com/xdb/2ab470a88220unverifiedvulncheckvulncheck.com/xdb/f3abef618150unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.