CVE-2023-2640
83Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 7.8epss 16%
from disclosure to weapon20 days
Published on NVDJul 26
1st PoC+20d
metasploitJul 26
VulnCheck+392d
exploitation probability
16%top 3% of all CVEs
observed exploitation
yesVulnCheck
11 public exploit(s)
On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Canonical · Ubuntu Kernelpublic PoCs found — 11
vulncheckvulncheck.com/xdb/8c496ca56767unverifiedvulncheckvulncheck.com/xdb/16afc028b0b7unverifiedvulncheckvulncheck.com/xdb/b0e74c253f25unverifiedvulncheckvulncheck.com/xdb/128ea6c187b0unverifiedvulncheckvulncheck.com/xdb/e23a0ab892f7unverifiedvulncheckvulncheck.com/xdb/388d1cda03e1unverifiedvulncheckvulncheck.com/xdb/394a6f854f06unverifiedvulncheckvulncheck.com/xdb/1db18c71756cunverifiedvulncheckvulncheck.com/xdb/504d2e538afbunverifiedvulncheckvulncheck.com/xdb/7a546463545aunverifiedvulncheckvulncheck.com/xdb/caa2d9116699unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.