CVE-2021-3493 Linux Kernel Privilege Escalation
Attackers can gain elevated privileges via overlayfs capability validation flaws in the Linux kernel when unprivileged user namespaces and overlay mounts are enabled.
- Exploited in the wild
- Since 20 Oct 2022
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3493?
CVE-2021-3493 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 17 Apr 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
Which versions are affected by CVE-2021-3493?
It affects 1 product.
Products include Canonical Ubuntu Linux.
How do I fix CVE-2021-3493?
Apply the vendor's patch. US federal agencies must fix it by 10 Nov 2022.
Is CVE-2021-3493 being exploited?
Yes. Attackers have exploited CVE-2021-3493 in the wild since at least 20 Oct 2022.
Public exploit code: 1 Metasploit module and 20 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2021-3493, GHSA-2fj2-4h38-3c72, UBUNTU-CVE-2021-3493.