module

GameOver(lay) Privilege Escalation and Container Escape

Disclosed
Jul 26, 2023

Description

This module exploits the use of unsafe functions in a number of Ubuntu kernels
utilizing vunerable versions of overlayfs. To mitigate CVE-2021-3493 the Linux
kernel added a call to vfs_setxattr during ovl_do_setxattr. Due to independent
changes to the kernel by the Ubuntu development team __vfs_setxattr_noperm is
called during ovl_do_setxattr without calling the intermediate safety function
vfs_setxattr. Ultimatly this module allows for root access to be achieved by
writing setuid capabilities to a file which are not sanitized after being unioned
with the upper mounted directory.
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.