Executive brief
A security vulnerability has been identified in the Linux kernel's OverlayFS component, which is commonly used for managing file systems in container environments and live operating systems. This flaw allows a person who already has limited access to a computer to gain full administrative (root) control. Such an escalation of privileges could allow an attacker to bypass security restrictions, access sensitive data, or disrupt system operations.
Technical details
An improper ownership management vulnerability (CWE-282) exists in the Linux kernel's OverlayFS subsystem. The flaw occurs during the process of copying a file with setuid capabilities from a 'nosuid' mount into another mount point. Due to a bug in UID mapping, the kernel fails to properly restrict the execution of these files, allowing a local, unprivileged attacker to execute a specially crafted file with elevated privileges. This effectively results in a local privilege escalation (LPE) to root. Patches have been released for major distributions including Debian and Ubuntu.
Affected products
- Linux Linux Kernel OverlayFS subsystem
- CanonicalHeader Ubuntu Linux 18.04 LTS, 20.04 LTS, 22.04 LTS
- Debian Debian Linux 10.0
Timeline
- 2023-06-01: advisory: Debian LTS security advisory published
- 2025-06-17: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2025-06-17: disclosed: Public disclosure date listed in advisory