34 lines
1.3 KiB
Markdown
34 lines
1.3 KiB
Markdown
# CVE-2023-32629: GameOver(lay) part 2: Ubuntu OverlayFS skips permission checks on copy-up xattr
|
|
|
|
**Scope:** [audit](../README.md) · [README](../../README.md) · [COMPARISON](../../COMPARISON.md) · [docs/RESEARCH](../../docs/RESEARCH.md)
|
|
|
|
High severity. Wiz/ProjectDiscovery, 2023.
|
|
|
|
## Source
|
|
|
|
- [Wiz blog: Ubuntu OverlayFS vulnerability](https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability)
|
|
- [ProjectDiscovery writeup](https://blog.projectdiscovery.io/gameover-lay-local-privilege-escalation-in-ubuntu-kernel/)
|
|
|
|
## Relevance to doos
|
|
|
|
The second GameOver(lay) flaw: a separate skip of permission checks in overlayfs's
|
|
copy-up path when setting extended attributes, affecting a slightly different kernel
|
|
version range than `CVE-2023-2640` but the same end result. Same relevance to doos as the
|
|
other overlayfs entries: doos's attach path is exactly this mount.
|
|
|
|
|
|
## What the check does
|
|
|
|
Kernel version check against the versions ProjectDiscovery listed for this CVE on
|
|
Ubuntu. No exploit code.
|
|
|
|
|
|
## Caveats
|
|
|
|
Same limits as `CVE-2023-2640`: the published affected matrix is a snapshot, not a
|
|
definitive oracle for every point release; treat FAIL as a prompt to check the Ubuntu
|
|
security notice for the exact running build.
|
|
|
|
|
|
Run: `make test` in this directory, or `make -C audit test` from the repo root.
|