39 lines
1.8 KiB
Markdown
39 lines
1.8 KiB
Markdown
# CVE-2023-2640: GameOver(lay) part 1: Ubuntu OverlayFS skips capability conversion on copy-up
|
|
|
|
**Scope:** [audit](../README.md) · [README](../../README.md) · [COMPARISON](../../COMPARISON.md) · [docs/RESEARCH](../../docs/RESEARCH.md)
|
|
|
|
High severity. Wiz/ProjectDiscovery, 2023. Reported to affect ~40% of Ubuntu cloud workloads.
|
|
|
|
## Source
|
|
|
|
- [Wiz blog: Ubuntu OverlayFS vulnerability](https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability)
|
|
- [ProjectDiscovery writeup](https://blog.projectdiscovery.io/gameover-lay-local-privilege-escalation-in-ubuntu-kernel/)
|
|
|
|
## Relevance to doos
|
|
|
|
A second, later regression of the same bug class as `CVE-2021-3493` in Ubuntu's overlayfs
|
|
patch set: file security capabilities were not converted before copy-up, so a user
|
|
namespace with its own (locally scoped) admin-like capabilities could create a file that
|
|
carries root-equivalent capabilities once it reached a context without that namespace
|
|
restriction. Same relevance to doos as `CVE-2021-3493`: this is doos's core mount, not an
|
|
unrelated code path.
|
|
|
|
|
|
## What the check does
|
|
|
|
Kernel version/build check against the affected matrix Wiz published (Ubuntu 22.04 and
|
|
20.04 on kernel 5.15.0, Ubuntu 18.04 on kernel 5.4.0, as a work-in-progress matrix at
|
|
disclosure time). Reports FAIL for an exact match on the affected major.minor with no
|
|
newer point release info available to this script, PASS otherwise. No exploit code.
|
|
|
|
|
|
## Caveats
|
|
|
|
Wiz's own affected-version matrix was explicitly marked a work in progress at
|
|
publication, and this check has no way to tell a patched point release of 5.15.0 from an
|
|
unpatched one from `uname -r` alone; treat FAIL here as "go check the Ubuntu security
|
|
notice for this exact build", not as a confirmed exploit.
|
|
|
|
|
|
Run: `make test` in this directory, or `make -C audit test` from the repo root.
|