Team CVE-MD

This repository provides a proof of concept for CVE-2023-0386: https://nvd.nist.gov/vuln/detail/CVE-2023-0386

Team members: Bǎnicǎ Dragoș-Marius and Borsos Matheas-Roland

Here is the video: https://www.youtube.com/watch?v=Ikux1rjIYP0

CVE-2023-0386 — Linux OverlayFS Local Privilege Escalation (PoC)

Overview

This repository contains a proof-of-concept (PoC) exploit for CVE-2023-0386, a local privilege escalation vulnerability in the Linux kernel OverlayFS subsystem.

The vulnerability allows a local, unprivileged user to escalate privileges to root by exploiting incorrect handling of file capabilities and ownership during OverlayFS copy-up operations. The PoC demonstrates how a carefully crafted OverlayFS setup can produce an executable that retains elevated privileges, even when copied from a nosuid mount.

Vulnerability Background

What Is OverlayFS?

OverlayFS is a union filesystem used to combine multiple directory trees into a single unified view. It is heavily used in:

• Containers (Docker, Kubernetes)
• Sandboxing systems
• Immutable OS layouts

OverlayFS consists of:

• Lower layer (read-only)
• Upper layer (writable)
• Merged view

When a file from the lower layer is modified, OverlayFS performs a copy-up operation: the file is copied into the upper layer and then modified there.

Root Cause of CVE-2023-0386

The vulnerability lies in how OverlayFS handles file metadata during copy-up, specifically:

• File capabilities (e.g., CAP_SETUID)
• Ownership and permission bits
• Interactions with nosuid mount options
• User namespace UID/GID mappings

In affected kernel versions:

• OverlayFS fails to properly strip capabilities when copying files from a nosuid lower layer.
• Under certain conditions, the copied file retains elevated attributes.
• Execution of this file allows escalation to root.

This breaks the security assumption that nosuid mounts prevent privilege escalation.

Repository Structure

CVE-2023-0386_POC/
├── exp.c # Main exploit logic
├── fuse.c # User-space filesystem helper (FUSE)
├── getshell.c # Privilege escalation payload
├── ovlcap/ # OverlayFS capability test utilities
│ ├── Makefile
│ └── ...
├── Makefile # Top-level build instructions
└── README.md

High-Level Exploit Flow

1. Controlled Filesystem Setup

• A FUSE filesystem is mounted to simulate a nosuid lower layer.
• OverlayFS is configured with a writable upper layer.

2. Capability-Bearing Binary

• A binary with file capabilities is placed in the lower layer.

3. Copy-Up Trigger

• OverlayFS copies the file into the upper layer.
• Due to the vulnerability, capability stripping is incomplete.

4. Privilege Escalation

• The copied binary is executed.
• Kernel mistakenly grants elevated privileges.
• A root shell is spawned.

Proof of Concept

System Requirements

• VM with Ubuntu 22.04 OS
• A vulnerable kernel (5.15.0-25-generic)
• FUSE support enabled
• Development tools:
  • gcc
  • make
  • libfuse-dev (or equivalent)
  • libcap-dev (or equivalent)

Build

git clone https://github.com/dragosbanica/CVE-2023-0386_POC.git
cd CVE-2023-0386_POC
make all

How to use

Start two terminals and in the first one type

./fuse ./ovlcap/lower ./gc

In the second terminal type

./exp