CVE-2021-3493

The overlayfs stacking file system in the Linux kernel does not properly validate the application of file capabilities against user namespaces, so capability checks can be bypassed when overlayfs is used inside a user namespace (CWE-862, missing authorization). A local attacker who can create user namespaces and mount an overlayfs filesystem can place a file with crafted file capabilities on that mount and execute it, gaining capabilities beyond their own namespace and escalating to root on the host. Any Linux deployment that enables unprivileged user namespaces with overlayfs support is affected; the flaw is specific to distribution kernels exposing this feature (known to affect Ubuntu builds), not every upstream kernel configuration. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2022-10-20, confirming exploitation in the wild, though no public proof-of-concept is catalogued in the source data and EPSS estimates a roughly 49% probability of exploitation within 30 days.

What to do: Apply updated kernel packages from your distribution per vendor instructions, as CISA's KEV entry requires, and reboot into the patched kernel (Ubuntu resolved this flaw in its July 2021 kernel security updates). As an interim mitigation, restrict or disable unprivileged user namespaces via system policy or sysctl and limit local access to trusted users. Verify the running kernel version after reboot, since the fix is not effective until the system boots the updated kernel.