The U.S. Cybersecurity and Infrastructure Safety Company (CISA) on Tuesday positioned a safety flaw impacting the Linux kernel in its Recognized Exploited Vulnerabilities (KEV) catalog, stating it has been actively exploited within the wild.
The vulnerability, CVE-2023-0386 (CVSS rating: 7.8), is an improper possession bug within the Linux kernel that could possibly be exploited to escalate privileges on vulnerable techniques. It was patched in early 2023.
“Linux kernel accommodates an improper possession administration vulnerability, the place unauthorized entry to the execution of the setuid file with capabilities was discovered within the Linux kernel’s OverlayFS subsystem in how a consumer copies a succesful file from a nosuid mount into one other mount,” the company mentioned.
“This uid mapping bug permits an area consumer to escalate their privileges on the system.”
It is presently not identified how the safety flaw is being exploited within the wild. In a report revealed in Could 2023, Datadog mentioned the vulnerability is trivial to take advantage of and that it really works by tricking the kernel into making a SUID binary owned by root in a folder like “/tmp” and executing it.
“CVE-2023-0386 lies in the truth that when the kernel copied a file from the overlay file system to the ‘higher’ listing, it didn’t test if the consumer/group proudly owning this file was mapped within the present consumer namespace,” the corporate mentioned.
“This enables an unprivileged consumer to smuggle an SUID binary from a ‘decrease’ listing to the ‘higher’ listing, through the use of OverlayFS as an middleman.”
Later that 12 months, cloud safety agency Wiz detailed two safety vulnerabilities dubbed GameOver(lay) (CVE-2023-32629 and CVE-2023-2640) affecting Ubuntu techniques that led to comparable penalties as CVE-2023-0386.
“These flaws enable the creation of specialised executables, which, upon execution, grant the power to escalate privileges to root on the affected machine,” Wiz researchers mentioned.
Federal Civilian Government Department (FCEB) companies are required to use the required patches by July 8, 2025, to safe their networks towards lively threats.
