CVE-2021-3493

CVE Published 2021-04-17
Related CWE(s) CWE-863: Incorrect Authorization, CWE-270: Privilege Context Switching Error
Related Vendor(s) canonical
Related Product(s) ubuntu_linux
Exploitation Reported (CISA KEV) 2022-10-20
CVSS 3 Base Score 8.8 (HIGH)
CVSS 3 Attack Complexity LOW
CVSS 3 Attack Vector LOCAL

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

Cyber Threat Graph Context

Explore how this CVE relates to the wider threat graph

Associated CAPEC Patterns

References