CVE-2023-2640: GameOver(lay) part 1: Ubuntu OverlayFS skips capability conversion on copy-up
Scope: audit · README · COMPARISON · docs/RESEARCH
High severity. Wiz/ProjectDiscovery, 2023. Reported to affect ~40% of Ubuntu cloud workloads.
Source
Relevance to doos
A second, later regression of the same bug class as CVE-2021-3493 in Ubuntu's overlayfs
patch set: file security capabilities were not converted before copy-up, so a user
namespace with its own (locally scoped) admin-like capabilities could create a file that
carries root-equivalent capabilities once it reached a context without that namespace
restriction. Same relevance to doos as CVE-2021-3493: this is doos's core mount, not an
unrelated code path.
What the check does
Kernel version/build check against the affected matrix Wiz published (Ubuntu 22.04 and 20.04 on kernel 5.15.0, Ubuntu 18.04 on kernel 5.4.0, as a work-in-progress matrix at disclosure time). Reports FAIL for an exact match on the affected major.minor with no newer point release info available to this script, PASS otherwise. No exploit code.
Caveats
Wiz's own affected-version matrix was explicitly marked a work in progress at
publication, and this check has no way to tell a patched point release of 5.15.0 from an
unpatched one from uname -r alone; treat FAIL here as "go check the Ubuntu security
notice for this exact build", not as a confirmed exploit.
Run: make test in this directory, or make -C audit test from the repo root.