CVE-2023-0386
Linux Kernel Improper Ownership Management Vulnerability
Description
CVE-2023-0386 is a high-severity local privilege escalation vulnerability in the Linux kernel's OverlayFS subsystem. The flaw stems from improper ownership management when a user copies a setuid file with capabilities from a nosuid mount into another mount, allowing a local attacker with low privileges to escalate to root. Rated 7.8 on the CVSS v3.1 scale (HIGH severity), the vulnerability requires local access but no user interaction, making it a reliable privilege escalation vector. CISA has added CVE-2023-0386 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 61.56% at the 98th percentile indicates widespread exploitation in the wild. The vulnerability affects Linux kernel versions from 5.11 through 6.2 and multiple distributions including Debian and Ubuntu.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| debian | debian linux | 10.0 |
| netapp | h300s firmware | - |
| netapp | h500s firmware | - |
| netapp | h700s firmware | - |
| netapp | h410s firmware | - |
| netapp | h410c firmware | - |
| canonical | ubuntu linux | 18.04; 20.04; 22.04 |
| linux | linux kernel | >= 5.11, < 5.15.91; >= 5.16, < 6.1.9; 6.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html(Third Party Advisory)
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a(Broken Link, Mailing List, Patch, Vendor Advisory)
- https://lists.debian.org/debian-lts-announce/2023/06/msg00008.html(Mailing List, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html(Mailing List, Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20230420-0004/(Third Party Advisory)
- https://www.debian.org/security/2023/dsa-5402(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0386(US Government Resource)
Weakness Type
CWE-282: Improper Ownership Management
The improper ownership management weakness in CVE-2023-0386 relates to how the Linux kernel's OverlayFS subsystem handles file ownership during copy operations. When a setuid file with capabilities is copied from a nosuid mount to another mount, the kernel fails to properly manage the uid mapping, allowing a local user to gain elevated privileges by exploiting the ownership discrepancy between the overlay layers.
Learn more: CWE-282 — Improper Ownership Management
Impact Analysis
The impact of CVE-2023-0386 is severe for local system security, with Confidentiality (High), Integrity (High), and Availability (High) all fully compromised upon successful exploitation. The attack vector is local (AV:L), meaning the attacker needs existing access to the system, but the complexity is low (AC:L) and only low-level privileges (PR:L) are required with no user interaction (UI:N). This makes the vulnerability a highly reliable privilege escalation path from any unprivileged user account to root. An attacker who has gained initial access through any means, such as a compromised web application or SSH access, can escalate to full root privileges. With an EPSS score of 61.6% at the 98th percentile, this is among the most actively exploited Linux kernel vulnerabilities, frequently used in post-compromise attack chains. The widespread use of OverlayFS in container environments amplifies the risk significantly.
Exploit Maturity
CVE-2023-0386 exhibits very high exploit maturity with an EPSS score of 61.56% at the 98th percentile, confirming it is among the most actively exploited Linux kernel vulnerabilities. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog. Public exploit information is available through Packet Storm Security, and the vulnerability is well-documented in kernel security patches. As a local privilege escalation vulnerability in the widely-used OverlayFS subsystem, it is a favored post-exploitation tool for attackers who have gained initial access to Linux systems, particularly in cloud and container environments where OverlayFS is the default storage driver.
Remediation
-
Update the Linux kernel immediately to a patched version. For kernel 5.15.x, upgrade to version 5.15.91 or later. For kernel 6.1.x, upgrade to version 6.1.9 or later. For kernel 6.2, apply the latest available patches. Distribution-specific updates are available for Debian and Ubuntu (18.04, 20.04, 22.04).
-
Apply kernel live patches where available to mitigate the vulnerability without requiring a system reboot. Canonical provides live patches through their Livepatch service, and similar services are available from Red Hat and other vendors.
-
Restrict OverlayFS mount capabilities as an interim mitigation. Disable user namespaces where not required by setting the kernel parameter
user.max_user_namespaces=0, and restrict the ability to create overlay mounts with nosuid sources through appropriate mount options and security module policies. -
Audit systems for signs of privilege escalation by reviewing system logs for unexpected setuid file creation, checking for unauthorized root processes, and scanning for persistence mechanisms such as modified system binaries or crontab entries.
-
Harden container environments where OverlayFS is the default storage driver. Review container security policies to ensure that capabilities are properly dropped, user namespace remapping is enabled, and seccomp profiles restrict unnecessary system calls related to mount operations.
Technical Details
CVE-2023-0386 is a privilege escalation vulnerability in the Linux kernel's OverlayFS subsystem, rooted in improper ownership management during file copy operations across mount boundaries. The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a local attack (AV:L) with low complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N), with high impact across all three CIA dimensions. The vulnerability specifically occurs when a user copies a file that has setuid permissions and extended capabilities from a filesystem mounted with the nosuid option into an overlay mount that does not have the nosuid restriction. The kernel's OverlayFS implementation fails to properly handle the UID mapping during this copy operation, allowing the setuid bit and capabilities to be preserved in the destination despite originating from a nosuid mount. An unprivileged user can exploit this by creating a user namespace, setting up a suitable OverlayFS configuration with a nosuid lower layer, and copying a specially prepared setuid binary to the upper layer where the setuid bit becomes effective. The fix in kernel versions 5.15.91, 6.1.9, and later implements proper validation of file ownership and capabilities during overlay copy-up operations.
Frequently Asked Questions
Is CVE-2023-0386 being actively exploited?
Yes, CISA has confirmed active exploitation by adding CVE-2023-0386 to the Known Exploited Vulnerabilities catalog. The EPSS score of 61.56% at the 98th percentile places it among the most actively exploited Linux kernel vulnerabilities. It is commonly used as a post-compromise privilege escalation tool.
What products are affected by CVE-2023-0386?
Linux kernel versions 5.11 through 5.15.90, 5.16 through 6.1.8, and 6.2 are affected. Distributions including Debian 10.0, Ubuntu 18.04/20.04/22.04, and multiple NetApp firmware products are also vulnerable. Any system using OverlayFS with these kernel versions is at risk.
How do I fix CVE-2023-0386?
Update the Linux kernel to versions 5.15.91, 6.1.9, or later. Apply distribution-specific patches from Debian, Ubuntu, or your vendor. As an interim mitigation, restrict user namespace creation and OverlayFS mount capabilities where not required.
How severe is CVE-2023-0386?
CVE-2023-0386 has a CVSS v3.1 score of 7.8 (HIGH severity). While it requires local access, the low complexity and low privilege requirements make it a reliable escalation path from any local user to root. The 98th percentile EPSS ranking underscores its widespread exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.