CVE-2023-2640
Published: 26 July 2023
Summary
CVE-2023-2640 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Canonical Ubuntu Linux. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-2640 affects Ubuntu kernels that include both commit c914c0e27eb0 and the Ubuntu-specific overlayfs sauce patch titled "Skip permission checking for trusted.overlayfs.* xattrs." The flaw resides in the overlayfs implementation and permits an unprivileged local user to set privileged extended attributes on files within a mounted overlay filesystem; these attributes are then applied to the upper layer without the normal security checks that would otherwise restrict them to privileged processes.
An attacker with a local account can therefore abuse the missing permission validation to write arbitrary trusted.overlayfs.* xattrs. Successful exploitation grants the ability to influence file metadata and behavior in ways normally reserved for root, resulting in high impact to confidentiality, integrity, and availability on the affected system.
Ubuntu Security Notice USN-6250-1 and the associated kernel-team mailing-list announcement describe the corrective action as installation of the updated kernel packages that restore proper permission checks for the affected xattrs. The notice lists the specific Ubuntu releases and kernel versions that received the fix.
The EPSS score for this CVE stands at 0.9247 with no subsequent rise indicated.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-34106
Vulnerability details
On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate…
more
security checks.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Periodic review and update of procedures reduces incorrect authorization implementations over time.
Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.
Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.
The authorization process and usage restrictions help prevent incorrect authorization for remote access types.
Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.
Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.
Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.
Ensures authorization decisions for external system use are correctly implemented and enforced.