Executive brief
fuse-overlayfs is a tool used to manage file systems for rootless containers, allowing users to run containers without administrative privileges. A vulnerability exists where certain file operations (truncating a file) fail to remove special security permissions (SUID/SGID bits) as they should. This could allow a low-privileged user to maintain elevated permissions on a file unexpectedly, potentially leading to unauthorized privilege assignment within the container environment.
Technical details
A vulnerability in the C implementation of fuse-overlayfs (release-1.x branch) occurs because the program preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate operations. While standard write operations correctly clear these bits, the truncate path fails to do so when a file is copied up to the upper layer. A local, low-privileged attacker can exploit this by truncating a writable file through the merged mount, resulting in an upper-layer file that retains elevated privileges (e.g., mode 4777). This issue is specific to the C-based release branch and does not affect the Rust rewrite. The vulnerability is fixed in version 1.17 by explicitly clearing these bits during truncation.
Affected products
- containers fuse-overlayfs < 1.17
Timeline
- 2026-06-09: patched: Fix committed and version 1.17 released
- 2026-07-29: disclosed: Public advisory and CVE published