CVE-2021-3493
Linux Kernel Privilege Escalation Vulnerability
Description
CVE-2021-3493 is a privilege escalation vulnerability in the Linux kernel's overlayfs filesystem implementation that allows a local unprivileged user to gain root access. The flaw exists because the overlayfs stacking filesystem does not properly validate the application of file capabilities against user namespaces, enabling a low-privileged attacker to set arbitrary capabilities on files within an overlay mount. With an EPSS score of 75.55% (98.88th percentile), this Linux kernel vulnerability is highly likely to be actively exploited. CISA added CVE-2021-3493 to the Known Exploited Vulnerabilities catalog on October 20, 2022.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| canonical | ubuntu linux | < 18.04; >= 18.04.1, < 20.04; < 20.10 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.html(Press/Media Coverage, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52(Mailing List, Patch, Third Party Advisory)
- https://ubuntu.com/security/notices/USN-4917-1(Vendor Advisory)
- https://www.openwall.com/lists/oss-security/2021/04/16/1(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3493(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CVE-2021-3493 is rooted in improper privilege management within the Linux kernel's overlayfs implementation. The kernel fails to properly enforce privilege boundaries when applying file capabilities in user namespace contexts, allowing unprivileged users to escalate to root by exploiting the overlayfs capability handling logic.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2021-3493 is a high-severity local privilege escalation vulnerability that requires an attacker to have local access with low privileges but no user interaction. The attack complexity is low, making exploitation straightforward once an attacker has local access to the system. Confidentiality, integrity, and availability are all critically impacted, as successful exploitation grants full root access to the underlying system, enabling the attacker to read any file, modify any data, and disrupt any service. The EPSS score of 75.55% indicates very high likelihood of active exploitation, and the vulnerability is particularly dangerous in shared hosting, containerized, and cloud environments where user namespace overlayfs operations are common.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-3493 in the wild by adding it to the Known Exploited Vulnerabilities catalog on October 20, 2022. The EPSS score of 75.55% (98.88th percentile) indicates very high exploitation probability. Public proof-of-concept exploit code is widely available and reliable, making this vulnerability accessible to even low-skilled attackers with local access. The ransomware association is classified as unknown.
Remediation
- Update the Linux kernel: Apply the kernel patch that addresses the overlayfs capability handling flaw. For Ubuntu systems, this was patched in kernel updates released in April 2021.
- Restrict user namespace access: If the kernel cannot be updated immediately, restrict unprivileged user namespace creation by setting
kernel.unprivileged_userns_clone=0on systems where this feature is not required. - Audit container configurations: Review container environments that rely on overlayfs to ensure they are running patched kernels, as this vulnerability is particularly impactful in containerized deployments.
- Monitor for privilege escalation indicators: Check system logs for suspicious overlayfs mount operations, unexpected capability changes, and processes running with elevated privileges that do not match expected patterns.
- Implement kernel live patching: Consider using kernel live patching solutions (e.g., Canonical Livepatch, KernelCare) to address this and future kernel vulnerabilities without service interruption.
Technical Details
CVE-2021-3493 exploits a flaw in the Linux kernel's overlayfs implementation where file capabilities are not properly validated against user namespaces. The overlayfs filesystem allows stacking multiple filesystem layers, commonly used in container runtimes like Docker and LXC. When a file is copied up from a lower layer to an upper layer in an overlay mount within a user namespace, the kernel incorrectly applies file capabilities without verifying that the user has the necessary privileges in the initial (root) user namespace. An attacker can create a user namespace, mount an overlayfs filesystem, and then manipulate file capabilities to set privileged capabilities on a binary. When that binary is subsequently executed outside the user namespace context, it runs with the elevated capabilities, effectively granting root access on the host system.
Frequently Asked Questions
Is CVE-2021-3493 being actively exploited?
Yes, CVE-2021-3493 is being actively exploited. CISA added it to the Known Exploited Vulnerabilities catalog on October 20, 2022. The EPSS score of 75.55% indicates very high exploitation activity, and public exploit code is widely available.
What products are affected by CVE-2021-3493?
CVE-2021-3493 affects the Linux kernel, specifically the overlayfs filesystem implementation. Ubuntu distributions were particularly impacted, as they enable unprivileged user namespaces by default. Any Linux distribution using affected kernel versions with overlayfs support is potentially vulnerable.
How do I fix CVE-2021-3493?
Update the Linux kernel to a version that includes the overlayfs capability validation fix. As a workaround, disable unprivileged user namespace creation by setting the sysctl kernel.unprivileged_userns_clone=0. See the Remediation section for detailed steps.
How severe is CVE-2021-3493?
CVE-2021-3493 is a high-severity privilege escalation vulnerability with an EPSS score of 75.55% (98.88th percentile). It allows local users to gain root access with low attack complexity, making it one of the most impactful Linux kernel privilege escalation vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.