CVE-2023-2640

State: Published
Severity: 7.8 High
Published: Jul 26, 2023
Updated: Oct 23, 2024
Reserved: May 10, 2023

Description

On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	canonical

Weaknesses

CWE-863

Affected Products

Product	Versions
Ubuntu KernelCanonical	before 6.2.0-26.26Not affected before 6.0.0-1020.20Not affected before 5.4.0-155.172Not affected

References

https://ubuntu.com/security/notices/USN-6250-1vendor-advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2640issue-tracking
https://wiz.io/blog/ubuntu-overlayfs-vulnerabilitytechnical-description
https://lists.ubuntu.com/archives/kernel-team/2023-July/140923.htmlmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.