CVE-2021-3493

Ubuntu linux kernel

Published 17 Apr 2021 · updated 17 Jun 2026 · Analyzed

7.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 20 Oct 2022, with a remediation deadline of 10 Nov 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

References

packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.html · Exploit, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.html · Press/Media Coverage, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.html · Exploit, Third Party Advisory, VDB Entry
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52 · Mailing List, Patch, Third Party Advisory
ubuntu.com/security/notices/USN-4917-1 · Vendor Advisory
www.openwall.com/lists/oss-security/2021/04/16/1 · Mailing List, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3493 · US Government Resource