A vulnerability (CVE-2023-0386) has been identified in the Linux kernel's implementation of the OverlayFS file system, which can be exploited to gain root access on systems where the FUSE subsystem is installed and where mounting OverlayFS partitions is allowed for unprivileged users (starting from Linux kernel 5.11 with the inclusion of unprivileged user namespaces). The issue has been resolved in the 6.2 kernel branch. Updates to packages in distributions can be tracked on the following pages: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch.
The attack is carried out by copying files with setgid/setuid flags from a partition mounted in nosuid mode to an OverlayFS partition that has a layer associated with a partition allowing the execution of suid files. The vulnerability is similar to the issue CVE-2021-3847 identified in 2021, but has lower exploitation requirements — the old issue required manipulation of xattrs, which are restricted when using user namespaces, while the new problem utilizes setgid/setuid bits that are not specifically processed in the user namespace.
The attack algorithm is as follows:
- Using the FUSE subsystem, a file system with an executable file owned by the root user with setuid/setgid flags, accessible to all users for writing, is mounted. When mounted, FUSE sets the mode to 'nosuid'.
- User and mount namespaces are unshared (unshare) from each other.
- OverlayFS is mounted, specifying the previously created FUSE file system as the lower layer and an upper layer based on a directory that allows writing. The upper layer directory must be located in a file system where the 'nosuid' flag is not used during mounting.
- The modification time for the suid file in the FUSE partition is changed using the touch utility, which results in its copying to the upper layer of OverlayFS.
- When copying, the kernel does not remove the setgid/setuid flags, causing the file to appear in a partition that allows processing of setgid/setuid.
- To gain root privileges, it is sufficient to execute the file with setgid/setuid flags from the directory attached to the upper layer of OverlayFS.
Additionally, it's worth noting that researchers from the Google Project Zero team disclosed details about three vulnerabilities that were fixed in the main branch of the Linux kernel 5.15 but were not backported to the kernel packages from RHEL 8.x/9.x and CentOS Stream 9.
- CVE-2023-1252 — a reference to a previously freed memory area in the ovl_aio_req structure during concurrent operations in OverlayFS deployed on top of the Ext4 filesystem. This vulnerability potentially allows privilege escalation in the system.
- CVE-2023-0590 — a reference to a previously freed memory area in the qdisc_graft() function. Exploitation is believed to be limited to crashes.
- CVE-2023-1249 — a reference to a previously freed memory area in the coredump write code, resulting from a missed mmap_lock call in file_files_note. Exploitation is believed to be limited to crashes.
Source: opennet.ru
