CVE-2023-2640 in Linux
Summary
by MITRE • 07/26/2023
On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/21/2026
This vulnerability exists in Ubuntu kernel versions that include specific commits related to overlay filesystem implementation. The flaw stems from improper handling of extended attributes within the overlayfs filesystem layer, specifically affecting the trusted.overlayfs.* namespace attributes. When an unprivileged user mounts an overlay filesystem and sets these particular extended attributes on files within the lower layers, the system fails to perform adequate permission validation before propagating these attributes to the upper layer files. This represents a privilege escalation vulnerability that allows users to bypass normal security controls that would typically prevent modification of privileged extended attributes.
The technical implementation issue lies in the overlayfs subsystem's failure to properly validate extended attribute operations when dealing with the trusted.overlayfs.* namespace. This namespace is intended for internal overlayfs operations but becomes exploitable when the kernel lacks proper access control checks for attribute modifications. The vulnerability specifically affects systems where the kernel includes both the commit c914c0e27eb0 and the SAUCE patch that modifies overlayfs permission checking behavior. The flaw creates a path where user-controlled extended attributes can be written to files in the upper layer without the necessary security validation that would normally occur during privileged operations.
Operationally, this vulnerability enables unprivileged users to gain elevated privileges by manipulating extended attributes on files within overlay filesystems. The impact extends beyond simple attribute manipulation as it allows for potential privilege escalation to root-level operations. Attackers can leverage this to set extended attributes that might influence system behavior or bypass security controls that depend on proper attribute validation. The vulnerability is particularly concerning in environments where overlay filesystems are commonly used for containerization, virtualization, or user home directories, as these scenarios often involve unprivileged user access to mounted filesystems.
Mitigation strategies should focus on applying the relevant kernel patches that address the overlayfs permission checking issue. System administrators should ensure that all Ubuntu systems are updated to kernel versions that contain the fixes for both the c914c0e27eb0 commit and the overlayfs SAUCE patch. Additionally, organizations should implement monitoring for unauthorized extended attribute modifications on overlay filesystems and consider restricting overlay filesystem usage in sensitive environments. The vulnerability aligns with CWE-276, which addresses improper privilege management, and maps to ATT&CK technique T1068, involving privilege escalation through local exploits. Organizations should also review their filesystem configurations to minimize exposure and implement least-privilege principles for overlay filesystem usage.