module
GameOver(lay) Privilege Escalation and Container Escape
| Disclosed |
|---|
| Jul 26, 2023 |
Disclosed
Jul 26, 2023
Description
This module exploits the use of unsafe functions in a number of Ubuntu kernels
utilizing vulnerable versions of overlayfs. To mitigate CVE-2021-3493 the Linux
kernel added a call to vfs_setxattr during ovl_do_setxattr. Due to independent
changes to the kernel by the Ubuntu development team __vfs_setxattr_noperm is
called during ovl_do_setxattr without calling the intermediate safety function
vfs_setxattr. Ultimatly this module allows for root access to be achieved by
writing setuid capabilities to a file which are not sanitized after being unioned
with the upper mounted directory.
utilizing vulnerable versions of overlayfs. To mitigate CVE-2021-3493 the Linux
kernel added a call to vfs_setxattr during ovl_do_setxattr. Due to independent
changes to the kernel by the Ubuntu development team __vfs_setxattr_noperm is
called during ovl_do_setxattr without calling the intermediate safety function
vfs_setxattr. Ultimatly this module allows for root access to be achieved by
writing setuid capabilities to a file which are not sanitized after being unioned
with the upper mounted directory.
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.