The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 17, 2021 |
| Ubuntu | — | Upgrade linux-image-lowlatencyUpgrade linux-image-4.15.0-1017-dell300xUpgrade linux-image-generic-lpaeUpgrade linux-image-4.4.0-209-generic-lpaeUpgrade linux-image-generic-64kUpgrade linux-image-5.8.0-1024-kvmUpgrade linux-image-4.15.0-142-lowlatencyUpgrade linux-image-5.3.0-1042-gkeUpgrade linux-image-gcpUpgrade linux-image-5.3.0-73-genericUpgrade linux-image-4.15.0-1084-raspi2Upgrade linux-image-raspi2Upgrade linux-image-4.4.0-209-powerpc64-embUpgrade linux-image-kvmUpgrade linux-image-gke-5.3Upgrade linux-image-4.4.0-1092-kvmUpgrade linux-image-5.6.0-1054-oemUpgrade linux-image-aws-hweUpgrade linux-image-5.8.0-1026-oracleUpgrade linux-image-4.4.0-209-powerpc-smpUpgrade linux-image-5.8.0-1021-raspiUpgrade linux-image-5.3.0-1039-raspi2Upgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-virtual-hwe-16.04Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.4.0-209-genericUpgrade linux-image-4.4.0-1127-awsUpgrade linux-image-5.4.0-1045-awsUpgrade linux-image-5.8.0-1029-azureUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oem-osp1Upgrade linux-image-raspiUpgrade linux-image-4.4.0-1151-raspi2Upgrade linux-image-oracle-lts-18.04Upgrade linux-image-4.4.0-1091-awsUpgrade linux-image-5.4.0-1038-kvmUpgrade linux-image-azure-lts-18.04Upgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-powerpc-e500mc-lts-xenialUpgrade linux-image-oem-20.04Upgrade linux-image-5.8.0-1021-raspi-nolpaeUpgrade linux-image-5.4.0-1014-gkeopUpgrade linux-image-powerpc64-emb-lts-xenialUpgrade linux-image-powerpc64-smpUpgrade linux-image-5.4.0-1042-gcpUpgrade linux-image-5.8.0-50-genericUpgrade linux-image-4.4.0-209-powerpc64-smpUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-gkeUpgrade linux-image-5.8.0-50-generic-64kUpgrade linux-image-dell300xUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-aws-lts-18.04Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-5.4.0-1046-azureUpgrade linux-image-gke-5.4Upgrade linux-image-gkeop-5.3Upgrade linux-image-awsUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-72-generic-lpaeUpgrade linux-image-4.15.0-1113-azureUpgrade linux-image-snapdragonUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-4.15.0-142-genericUpgrade linux-image-azureUpgrade linux-image-5.8.0-50-generic-lpaeUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-4.15.0-1099-awsUpgrade linux-image-powerpc-smp-lts-xenialUpgrade linux-image-5.3.0-73-lowlatencyUpgrade linux-image-4.4.0-209-lowlatencyUpgrade linux-image-5.8.0-1028-gcpUpgrade linux-image-powerpc-e500mcUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-gkeop-5.4Upgrade linux-image-5.4.0-72-lowlatencyUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-4.4.0-209-powerpc-e500mcUpgrade linux-image-oracle | Apr 16, 2021 | Apr 15, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub