CVE-2023-2640CWE-863

On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may…

High · published July 26, 2023

CVSS v3.1
7.8
EPSS
15%
Percentile
96.8
In the wild
Unconfirmed
What it is

On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.15199 · 96.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-07-26T01:59Z
EPSS history
Timeline
  • 26 JUL 01:59Z
    On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may…
    cvelistv5