Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-2640 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Canonical Ubuntu Linux. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-2640 affects Ubuntu kernels that include both commit c914c0e27eb0 and the Ubuntu-specific overlayfs sauce patch titled "Skip permission checking for trusted.overlayfs.* xattrs." The flaw resides in the overlayfs implementation and permits an unprivileged local user to set privileged extended attributes on files within a mounted overlay filesystem; these attributes are then applied to the upper layer without the normal security checks that would otherwise restrict them to privileged processes.
An attacker with a local account can therefore abuse the missing permission validation to write arbitrary trusted.overlayfs.* xattrs. Successful exploitation grants the ability to influence file metadata and behavior in ways normally reserved for root, resulting in high impact to confidentiality, integrity, and availability on the affected system.
Ubuntu Security Notice USN-6250-1 and the associated kernel-team mailing-list announcement describe the corrective action as installation of the updated kernel packages that restore proper permission checks for the affected xattrs. The notice lists the specific Ubuntu releases and kernel versions that received the fix.
The EPSS score for this CVE stands at 0.9247 with no subsequent rise indicated.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-34106
Vulnerability Data
On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate…
more
security checks.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Periodic review and update of procedures reduces incorrect authorization implementations over time.
Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.
Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.
The authorization process and usage restrictions help prevent incorrect authorization for remote access types.
Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.
Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.
Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.
Ensures authorization decisions for external system use are correctly implemented and enforced.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.
A.5.18's provisioning, revocation, review and adjustment of access rights (incl. before role changes/termination, with segregation and owner approval) directly stops incorrect authorization decisions from being exploitable in the vast majority of cases; the bounded remainder is incorrectness inside the authorization logic itself (e.g. flawed conditional or missing check) rather than rights that were wrongly granted.
A.8.3 directly mandates restricting access to information per policies via configuration, identity/group controls, isolation, and dynamic techniques that enforce correct authorization decisions, addressing most but not all slices of CWE-863 (e.g., remainder in non-access-decision authorization errors like timing or environmental factors).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-863, a class-level weakness, and none of its children carries one either.