module

GameOver(lay) Privilege Escalation and Container Escape

Try Surface Command
Back to search
Disclosed
Jul 26, 2023
Created
Dec 19, 2024

Description

This module exploits the use of unsafe functions in a number of Ubuntu kernels
utilizing vunerable versions of overlayfs. To mitigate CVE-2021-3493 the Linux
kernel added a call to vfs_setxattr during ovl_do_setxattr. Due to independent
changes to the kernel by the Ubuntu development team __vfs_setxattr_noperm is
called during ovl_do_setxattr without calling the intermediate safety function
vfs_setxattr. Ultimatly this module allows for root access to be achieved by
writing setuid capabilities to a file which are not sanitized after being unioned
with the upper mounted directory.

Authors

g1vi
h00die
bwatters-r7
gardnerapp

Platform

Linux,Unix

Architectures

aarch64, x64, cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/linux/local/gameoverlay_privesc
    msf exploit(gameoverlay_privesc) > show targets
        ...targets...
    msf exploit(gameoverlay_privesc) > set TARGET < target-id >
    msf exploit(gameoverlay_privesc) > show options
        ...show and set options...
    msf exploit(gameoverlay_privesc) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today