The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 17, 2021 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-snapdragonUpgrade linux-image-5.4.0-1042-gcpUpgrade linux-image-5.4.0-1038-kvmUpgrade linux-image-azure-lts-18.04Upgrade linux-image-4.4.0-1091-awsUpgrade linux-image-oem-osp1Upgrade linux-image-5.3.0-73-genericUpgrade linux-image-powerpc64-smpUpgrade linux-image-4.4.0-1127-awsUpgrade linux-image-5.8.0-1029-azureUpgrade linux-image-gkeop-5.3Upgrade linux-image-5.8.0-1021-raspiUpgrade linux-image-awsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-5.8.0-50-generic-64kUpgrade linux-image-5.4.0-1014-gkeopUpgrade linux-image-aws-hweUpgrade linux-image-5.8.0-1026-oracleUpgrade linux-image-4.15.0-1084-raspi2Upgrade linux-image-5.4.0-72-generic-lpaeUpgrade linux-image-raspiUpgrade linux-image-5.4.0-1046-azureUpgrade linux-image-5.8.0-50-genericUpgrade linux-image-4.4.0-209-genericUpgrade linux-image-4.4.0-1151-raspi2Upgrade linux-image-oracle-lts-18.04Upgrade linux-image-powerpc-e500mc-lts-xenialUpgrade linux-image-5.4.0-1045-awsUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-powerpc-smp-lts-xenialUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-5.6.0-1054-oemUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-powerpc64-emb-lts-xenialUpgrade linux-image-5.8.0-50-generic-lpaeUpgrade linux-image-gkeUpgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-4.4.0-209-powerpc-smpUpgrade linux-image-4.15.0-1099-awsUpgrade linux-image-oem-20.04Upgrade linux-image-aws-lts-18.04Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.4.0-209-powerpc64-smpUpgrade linux-image-dell300xUpgrade linux-image-gcpUpgrade linux-image-5.8.0-1021-raspi-nolpaeUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-4.15.0-142-genericUpgrade linux-image-gke-5.4Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-gke-5.3Upgrade linux-image-kvmUpgrade linux-image-4.4.0-209-powerpc64-embUpgrade linux-image-4.15.0-1113-azureUpgrade linux-image-azureUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-4.15.0-1070-oracleUpgrade linux-image-5.8.0-1028-gcpUpgrade linux-image-gkeopUpgrade linux-image-4.4.0-1092-kvmUpgrade linux-image-5.8.0-50-lowlatencyUpgrade linux-image-oem-20.04bUpgrade linux-image-genericUpgrade linux-image-4.15.0-1101-snapdragonUpgrade linux-image-5.3.0-1042-gkeUpgrade linux-image-4.4.0-209-lowlatencyUpgrade linux-image-raspi2Upgrade linux-image-generic-lpaeUpgrade linux-image-5.4.0-72-genericUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-5.4.0-1042-gkeUpgrade linux-image-5.3.0-73-lowlatencyUpgrade linux-image-powerpc64-embUpgrade linux-image-4.15.0-1017-dell300xUpgrade linux-image-lowlatencyUpgrade linux-image-raspi2-hwe-18.04Upgrade linux-image-4.4.0-1155-snapdragonUpgrade linux-image-generic-lts-xenialUpgrade linux-image-5.10.0-1022-oemUpgrade linux-image-powerpc-smpUpgrade linux-image-powerpc64-smp-lts-xenialUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-generic-lpae-lts-xenialUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.8.0-1024-kvmUpgrade linux-image-5.4.0-1043-oracleUpgrade linux-image-virtualUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-4.15.0-1090-kvmUpgrade linux-image-4.15.0-142-generic-lpaeUpgrade linux-image-5.8.0-1030-awsUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-5.4.0-1034-raspiUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.4.0-72-lowlatencyUpgrade linux-image-4.15.0-142-lowlatencyUpgrade linux-image-5.3.0-1039-raspi2Upgrade linux-image-powerpc-e500mcUpgrade linux-image-oracleUpgrade linux-image-4.4.0-209-generic-lpaeUpgrade linux-image-4.15.0-1098-gcpUpgrade linux-image-oemUpgrade linux-image-4.4.0-209-powerpc-e500mcUpgrade linux-image-gkeop-5.4Upgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-generic-64kUpgrade linux-image-snapdragon-hwe-18.04 | Apr 16, 2021 | Apr 15, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub