CVE-2021-3493 is a privilege escalation vulnerability in the Linux kernel's overlayfs implementation, specifically affecting Canonical Ubuntu Linux distributions. It arises from improper validation of file capabilities within user namespaces, allowing an attacker to gain elevated privileges when combined with an Ubuntu-specific patch enabling unprivileged overlay mounts. This vulnerability carries a high CVSS score of 7.8, indicating a low-complexity local attack that can lead to complete compromise of confidentiality, integrity, and availability. Notably, CVE-2021-3493 is actively exploited in the wild, has a Metasploit module available, and has garnered significant community discussion and media coverage, including its association with malware like Shikitega.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 18.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:lts:*:*:* | ||
>= 18.04.1, < 20.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:lts:*:*:* | ||
< 20.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:-:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
Apr 17, 2021kernel: overlayfs file system caps privilege escalation
Apr 16, 2021