GameOver(lay): Two Severe Linux Vulnerabilities Impact 40% of Ubuntu Users

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.

The overlayfs stacking file system in the Linux kernel does not properly validate the application of file capabilities against user namespaces, so capability checks can be bypassed when overlayfs is used inside a user namespace (CWE-862, missing authorization). A local attacker who can create user namespaces and mount an overlayfs filesystem can place a file with crafted file capabilities on that mount and execute it, gaining capabilities beyond their own namespace and escalating to root on the host. Any Linux deployment that enables unprivileged user namespaces with overlayfs support is affected; the flaw is specific to distribution kernels exposing this feature (known to affect Ubuntu builds), not every upstream kernel configuration. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2022-10-20, confirming exploitation in the wild, though no public proof-of-concept is catalogued in the source data and EPSS estimates a roughly 49% probability of exploitation within 30 days.

Do: Apply updated kernel packages from your distribution per vendor instructions, as CISA's KEV entry requires, and reboot into the patched kernel (Ubuntu resolved this flaw in its July 2021 kernel security updates). As an interim mitigation, restrict or disable unprivileged user namespaces via system policy or sysctl and limit local access to trusted users. Verify the running kernel version after reboot, since the fix is not effective until the system boots the updated kernel.

An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.

CVE-2023-0386 is an improper ownership management flaw (CWE-282) in the Linux kernel's OverlayFS subsystem: due to a user-namespace uid-mapping bug, a setuid file with file capabilities that is copied from a 'nosuid' mount into another mount can be executed as setuid without authorization. A local attacker with an ordinary low-privilege account can trigger the flaw simply by copying such a capable file, with no user interaction required. Successful exploitation yields local privilege escalation on the host, with high impact to confidentiality, integrity, and availability. Affected products include the Linux kernel, Ubuntu Linux, Debian Linux, and NetApp H-series appliance firmware (H300S, H410C, H410S, H500S, H700S); CISA's affected list names the Linux Kernel. The flaw is being actively exploited in the wild - CISA added it to the Known Exploited Vulnerabilities catalog on 2025-06-17, though ransomware use is listed as unknown.

Do: Apply vendor-supplied fixed kernel updates from Canonical or Debian and reboot affected hosts so the patched kernel is loaded; NetApp H300S/H500S/H700S/H410S/H410C systems should install fixed firmware per NetApp's advisory. Because the flaw is in the CISA KEV catalog (added 2025-06-17), follow BOD 22-01 guidance: apply vendor mitigations or discontinue use where fixes are unavailable, prioritizing multi-user servers and any host with untrusted local accounts.

On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.