CVE-2023-0386
Linux Kernel 5.11 – 5.15.91
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-0386 is a high-severity Improper Ownership Management (CWE-282) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-0386 is a privilege-escalation flaw in the Linux kernel's OverlayFS subsystem. The issue stems from improper UID mapping when a user copies a file that carries capabilities from a nosuid mount into another mount, allowing unauthorized execution of setuid binaries with elevated privileges. The vulnerability affects the kernel's handling of OverlayFS and is tracked under CWE-282.
A local attacker with a low-privileged account can exploit the flaw by performing the copy operation across mounts, resulting in the ability to execute code with root-level capabilities. The attack requires no user interaction and yields full confidentiality, integrity, and availability impact on the host, consistent with the CVSS 7.8 rating.
Kernel developers addressed the issue with commit 4f11ada10d0a. Debian issued updated packages through its LTS channels in 2023 and 2024, while NetApp published an advisory confirming affected storage products and recommending firmware or kernel updates.
EPSS for the CVE rose from lower values after disclosure to a peak of 0.6156 before receding to the current 0.4852, indicating measurable post-disclosure exploitation interest that later declined.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-12447
Vulnerability Data
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount…
more
into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
- CWE(s)
- KEV Date Added
- 17 June 2025
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Access control policies can enforce correct ownership assignment and verification for objects.
Identity management processes help ensure objects are assigned to the correct, verified owners.
Managing access rights includes verifying and maintaining proper ownership of resources.
Privileged access rights management requires accurate ownership to prevent unauthorized privilege escalation.
Information access restriction mechanisms rely on correct ownership to enforce access decisions.
Access to source code control depends on proper ownership assignment to protect intellectual property.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.