CVE-2026-52791 in fuse-overlayfs
Summary
by MITRE • 07/29/2026
fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The fuse-overlayfs project represents a critical implementation of overlay filesystem functionality within the FUSE framework, specifically designed for rootless container environments where users operate without elevated privileges. This system architecture allows non-root users to create and manage containerized applications by leveraging overlay filesystems that present multiple directory trees as a single unified view. The vulnerability resides within the main.c component of the release-1.x branch, where improper handling of file mode bits during specific operations creates a persistent security weakness. The issue manifests when processes perform open operations with O_TRUNC flag or truncate operations on files that have been copied up from lower layers to upper layers, creating a scenario where SUID and SGID permissions are inadvertently preserved across the copy operation.
The technical flaw stems from insufficient permission validation within the file handling routines of the overlay filesystem implementation. When a file is copied from the lower layer to the upper layer during these specific operations, the system fails to properly sanitize the file permissions, allowing the preservation of SUID (set user ID) and SGID (set group ID) bits that should normally be stripped during such copy operations. This creates a persistent vulnerability where a low-privileged process can manipulate files in such a way that the resulting upper-layer file retains the 4777 mode bits, indicating world-executable permissions with setuid/setgid capabilities. The vulnerability is particularly concerning because it operates at the filesystem level and affects the fundamental security model of containerized environments.
The operational impact of this vulnerability extends beyond simple privilege escalation, creating a potential attack vector that could allow malicious actors to gain unauthorized elevated privileges within containerized environments. When combined with other exploitation techniques, this flaw could enable attackers to execute arbitrary code with elevated permissions, effectively undermining the security boundaries that containers are designed to maintain. The persistence of these mode bits means that once exploited, the vulnerability can continue to provide unauthorized access until the underlying system is patched or the affected files are manually corrected, making it particularly dangerous in long-running containerized applications. This issue represents a failure in proper privilege separation and file system permission handling that directly violates security principles established by standards such as CWE-276, which addresses improper permissions.
The fix implemented in version 1.17 specifically addresses this vulnerability by ensuring that SUID and SGID bits are properly stripped during file copy operations in the overlay filesystem implementation. This mitigation aligns with the principle of least privilege and proper permission handling as outlined in various security frameworks including those referenced in the ATT&CK framework for container-based attacks. Organizations utilizing fuse-overlayfs in rootless container environments should prioritize immediate patching to address this vulnerability, particularly in production systems where unprivileged users might have access to containerized applications. The mitigation strategy involves updating to version 1.17 or later, which incorporates proper permission sanitization during file operations to prevent the preservation of setuid/setgid bits during copy-up operations, thereby maintaining the security boundaries that containerized environments depend upon for isolation and protection against unauthorized privilege escalation attempts.
This vulnerability demonstrates the critical importance of proper file permission handling in filesystem implementations, especially within containerized environments where multiple layers of security are expected to work together. The flaw serves as a reminder of how seemingly minor implementation details in system software can create significant security risks when they fail to properly enforce privilege boundaries and permission models that are fundamental to operating system security.