CVE-2023-0386
Linux Kernel 5.11 – 5.15.91
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2023-0386 is a high-severity Improper Ownership Management (CWE-282) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked in the top 6% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-0386 is a privilege-escalation flaw in the Linux kernel's OverlayFS subsystem. The issue stems from improper UID mapping when a user copies a file that carries capabilities from a nosuid mount into another mount, allowing unauthorized execution of setuid binaries with elevated privileges. The vulnerability affects the kernel's handling of OverlayFS and is tracked under CWE-282.
A local attacker with a low-privileged account can exploit the flaw by performing the copy operation across mounts, resulting in the ability to execute code with root-level capabilities. The attack requires no user interaction and yields full confidentiality, integrity, and availability impact on the host, consistent with the CVSS 7.8 rating.
Kernel developers addressed the issue with commit 4f11ada10d0a. Debian issued updated packages through its LTS channels in 2023 and 2024, while NetApp published an advisory confirming affected storage products and recommending firmware or kernel updates.
EPSS for the CVE rose from lower values after disclosure to a peak of 0.6156 before receding to the current 0.4852, indicating measurable post-disclosure exploitation interest that later declined.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-12447
Vulnerability Data
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount…
more
into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
- CWE(s)
- KEV Date Added
- 17 June 2025
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Managing and enforcing access permissions and authorizations directly addresses correct ownership assignment and verification for resources.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Access control policies can enforce correct ownership assignment and verification for objects.
Identity management processes help ensure objects are assigned to the correct, verified owners.
Managing access rights includes verifying and maintaining proper ownership of resources.
Privileged access rights management requires accurate ownership to prevent unauthorized privilege escalation.
Information access restriction mechanisms rely on correct ownership to enforce access decisions.
Access to source code control depends on proper ownership assignment to protect intellectual property.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Windows Server 2016 (1 rule)
- V-224973 The Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions. prevents CWE-282