CVE-2023-32629
Published: 26 July 2023
Summary
CVE-2023-32629 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Canonical Ubuntu Linux. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 1.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is a local privilege escalation flaw in Ubuntu kernels affecting the overlayfs implementation. Specifically, the function ovl_copy_up_meta_inode_data skips required permission checks when invoking ovl_do_setxattr, which is tracked under CWE-863 and carries a CVSS 3.1 score of 7.8.
A local attacker with low privileges can exploit the issue without user interaction to gain full control over confidentiality, integrity, and availability on the affected system. The flaw resides in the kernel's handling of extended attributes during overlay copy-up operations, allowing an unprivileged user to elevate rights on Ubuntu installations using overlayfs.
Ubuntu has issued patches through notices such as USN-6250-1 and corresponding kernel-team updates, along with live-patch packages referenced in LSN-0097-1. Administrators are advised to apply the available kernel updates or live patches to close the permission-check gap.
The EPSS score currently stands at 0.7634, matching its recorded peak, indicating sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-36872
Vulnerability details
Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu kernels
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Periodic review and update of procedures reduces incorrect authorization implementations over time.
Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.
Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.
The authorization process and usage restrictions help prevent incorrect authorization for remote access types.
Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.
Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.
Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.
Ensures authorization decisions for external system use are correctly implemented and enforced.