Linux Kernel OverlayFS Local Privilege Escalation Vulnerability (CVE-2023-0386) Analysis and Mitigation Guide

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-0386) is a local privilege escalation (LPE) flaw residing in the Linux kernel's OverlayFS subsystem. The root cause lies in how OverlayFS handles the copy-up process of a file with special capabilities or setuid permissions from a mount point configured with the nosuid option into another mount. Due to inadequate validation of UID mappings and execution permissions during this copy-up operation, the kernel fails to enforce the nosuid restriction, allowing unauthorized privilege transition.

2. Exploitation Mechanics & Attack Scenario

An attacker with local access leverages unprivileged user namespaces to mount a crafted filesystem with the nosuid option. Inside this mount, the attacker creates a binary owned by root with the setuid bit enabled. Normally, executing this binary from a nosuid mount prevents privilege escalation. However, by mounting an OverlayFS instance where this directory acts as the lower directory (lowerdir) and another directory acts as the upper directory (upperdir), the attacker can trigger a copy-up operation by writing to the file. OverlayFS copies the file to the upper directory without preserving the nosuid restriction, resulting in a fully functional root-owned setuid binary on the host filesystem, which the attacker executes to gain root privileges.

3. Infrastructure & Business Impact

With a CVSS score of 7.8 (High) and active exploitation documented in CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses a severe threat. It is particularly critical in multi-tenant environments, shared hosting, and containerized infrastructures (Docker/Kubernetes). A successful exploit allows an attacker who has compromised a container or obtained low-privilege shell access to escape isolation boundaries, compromise the host operating system, and gain full administrative control.