CVE-2021-3493: Ubuntu OverlayFS privilege escalation via missing user-namespace fscap check
Scope: audit · README · COMPARISON · docs/RESEARCH
CVSS 7.8 (High). CISA KEV. Fixed in Ubuntu kernels 5.8.0-50.56 / 5.4.0-72.80 / 4.15.0-142.146 / 4.4.0-209.241.
Source
Relevance to doos
Ubuntu's kernel carries a patch allowing unprivileged overlayfs mounts, which is exactly
what doos relies on for every attach (host mode overlays /usr and /opt, image mode
overlays an extracted rootfs). The kernel's overlayfs did not convert file capabilities
against the mounting user namespace before copy-up, so a crafted lower-layer file with a
capability xattr could grant that capability once copied into the upper layer and read
back outside the namespace, root-equivalent privileges from an ordinary unprivileged
overlay mount. This is the single most on-point kernel bug for doos's core design: it is
not "a container escape through some unrelated mechanism", it is the exact mount doos
issues on every attach.
What the check does
Kernel version against the fixed builds (branch-aware: 5.8/5.4/4.15/4.4 have published fixed point releases; anything on an unlisted branch between 4.4 and 5.11 is treated as unproven and reported, not assumed safe). No exploit code: this is a kernel capability-set bug, not something safe to trigger for real on the host running the check.
Caveats
This is the first of three overlayfs-in-userns kernel bugs in this audit (see also
CVE-2023-2640, CVE-2023-32629, CVE-2015-1328); together they are the strongest
argument for keeping the host kernel current, since doos's entire model depends on this
exact combination (overlayfs + unprivileged user namespace) staying safe.
Run: make test in this directory, or make -C audit test from the repo root.