Recommended action window: Monitor and triage in normal cycle
NVD description
On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
@_0xKiwi Wiz claimed to have “discovered” CVE-2023-2640, despite Stonejiajia reporting the exact vulnerability 51 days earlier. Even Canonical credits the original researcher. Wiz knew Ubuntu was already aware of it. Wiz: https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability Canonical: https://ubuntu.com/security/CVE-2023-2640
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | canonical | ubuntu_linux | 23.04 | - | - |