CISA Warns of Active Exploitation of Linux Kernel Privilege Escalation Vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-0386 | Local Privilege Escalation via OverlayFS in the Linux Kernel CVE-2023-0386 is an improper ownership management flaw (CWE-282) in the Linux kernel's OverlayFS subsystem: due to a user-namespace uid-mapping bug, a setuid file with file capabilities that is copied from a 'nosuid' mount into another mount can be executed as setuid without authorization. A local attacker with an ordinary low-privilege account can trigger the flaw simply by copying such a capable file, with no user interaction required. Successful exploitation yields local privilege escalation on the host, with high impact to confidentiality, integrity, and availability. Affected products include the Linux kernel, Ubuntu Linux, Debian Linux, and NetApp H-series appliance firmware (H300S, H410C, H410S, H500S, H700S); CISA's affected list names the Linux Kernel. The flaw is being actively exploited in the wild - CISA added it to the Known Exploited Vulnerabilities catalog on 2025-06-17, though ransomware use is listed as unknown. Do: Apply vendor-supplied fixed kernel updates from Canonical or Debian and reboot affected hosts so the patched kernel is loaded; NetApp H300S/H500S/H700S/H410S/H410C systems should install fixed firmware per NetApp's advisory. Because the flaw is in the CISA KEV catalog (added 2025-06-17), follow BOD 22-01 guidance: apply vendor mitigations or discontinue use where fixes are unavailable, prioritizing multi-user servers and any host with untrusted local accounts. | 7.8 | 8% | KEV |
| mass100M+ users (Ubuntu and Debian kernels ship OverlayFS system-wide; related reporting cites ~40% of Ubuntu users), plus an unknown number of NetApp H-series… | |
| CVE-2023-2640 +1 in the same advisory: …32629 | On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks. NVD description · AI analysis pending | 7.8 | 15% | PoC |
| — |
Full article353 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJun 18, 2025Linux / Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday placed a security flaw impacting the Linux kernel in its Known Exploited Vulnerabilities (KEV) catalog, stating it has been actively exploited in the wild.
The vulnerability, CVE-2023-0386 (CVSS score: 7.8), is an improper ownership bug in the Linux kernel that could be exploited to escalate privileges on susceptible systems. It was patched in early 2023.
"Linux kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel's OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount," the agency said.
"This uid mapping bug allows a local user to escalate their privileges on the system."
It's currently not known how the security flaw is being exploited in the wild. In a report published in May 2023, Datadog said the vulnerability is trivial to exploit and that it works by tricking the kernel into creating a SUID binary owned by root in a folder like "/tmp" and executing it.
"CVE-2023-0386 lies in the fact that when the kernel copied a file from the overlay file system to the 'upper' directory, it did not check if the user/group owning this file was mapped in the current user namespace," the company said.
"This allows an unprivileged user to smuggle an SUID binary from a 'lower' directory to the 'upper' directory, by using OverlayFS as an intermediary."
Later that year, cloud security firm Wiz detailed two security vulnerabilities dubbed GameOver(lay) (CVE-2023-32629 and CVE-2023-2640) affecting Ubuntu systems that led to similar consequences as CVE-2023-0386.
"These flaws allow the creation of specialized executables, which, upon execution, grant the ability to escalate privileges to root on the affected machine," Wiz researchers said.
Federal Civilian Executive Branch (FCEB) agencies are required to apply the necessary patches by July 8, 2025, to secure their networks against active threats.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/06/cisa-warns-of-active-exploitation-of.html