sornphut/overlayfs---cve-2021-3493Technical analysis of CVE-2021-3493, an Ubuntu OverlayFS local privilege escalation vulnerability, including root cause explanation and affected versions.
TL;DR
Find out how a vulnerability in OverlayFS allows local users under Ubuntu to gain root privileges.
Vulnerability Summary
An Ubuntu specific issue in the overlayfs file system in the Linux kernel where it did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges, due to a patch carried in Ubuntu to allow unprivileged overlayfs mounts.
CVE-2021-3493
Credit
An independent security researcher has reported this vulnerability to the SSD Secure Disclosure program.
Affected Versions
Ubuntu 20.10
Ubuntu 20.04 LTS
Ubuntu 18.04 LTS
Ubuntu 16.04 LTS
Ubuntu 14.04 ESM
Vendor Response
“We published security advisories for this issue today in
https://ubuntu.com/security/notices/USN-4915-1 https://ubuntu.com/security/notices/USN-4916-1 https://ubuntu.com/security/notices/USN-4917-1
as well as making the issue public in our CVE tracker:
https://ubuntu.com/security/CVE-2021-3493
The following is the content of the message was sent to the oss-security list: https://www.openwall.com/lists/oss-security/2021/04/16/1
Vulnerability Analysis
Linux supports file capabilities stored in extended file attributes that work similarly to setuid-bit, but can be more fine-grained. A simplified procedure for setting file capabilities in pseudo-code looks like this: setxattr(...): if cap_convert_nscap(...) is not OK: then fail vfs_setxattr(...)
The important call is cap_convert_nscap, which checks permissions with respect to namespaces.
If we set the file capabilities from our own namespace and on our own mount, there is no problem and we have permission to do so. The problem is that when OverlayFS forwards this operation to the underlying file system, it only calls vfs_setxattr and skips checks in cap_convert_nscap.
This allows to set arbitrary capabilities on files in outer namespace/mount, where they will also be applied during execution.
In Linux 5.11 the call to cap_convert_nscap was moved into vfs_setxattr, so it is no more vulnerable.
