{"id":107498,"date":"2023-03-24T12:48:20","date_gmt":"2023-03-24T10:48:20","guid":{"rendered":"https:\/\/prohoster.info\/?p=107498"},"modified":"2023-03-24T20:21:30","modified_gmt":"2023-03-24T18:21:30","slug":"uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","title":{"rendered":"Vulnerability in OverlayFS allowing privilege escalation","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability (CVE-2023-0386) has been identified in the Linux kernel's implementation of the OverlayFS file system, which can be exploited to gain root access on systems where the FUSE subsystem is installed and where mounting OverlayFS partitions is allowed for unprivileged users (starting from Linux kernel 5.11 with the inclusion of unprivileged user namespaces). The issue has been resolved in the 6.2 kernel branch. Updates to packages in distributions can be tracked on the following pages: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n
The attack is executed by copying files with setgid\/setuid flags from a mount point in nosuid mode into an OverlayFS layer that is linked to a partition allowing the execution of suid files. This vulnerability is similar to the issue CVE-2021-3847 identified in 2021, but has lower exploitation requirements \u2014 the old problem required manipulation of xattrs, which are restricted when using user namespaces, while the new issue utilizes setgid\/setuid bits that are not specifically handled in the user namespace. <\/p>\n
The attack algorithm is as follows: <\/p>\n
\n
A filesystem is mounted using the FUSE subsystem, containing an executable file owned by the root user with setuid\/setgid flags, accessible for write by all users. When mounted, FUSE sets the mode to 'nosuid.'\n
User and mount namespaces are unshared (unshare) from each other.\n
OverlayFS is mounted, specifying the previously created FUSE filesystem as the lower layer and an upper layer based on a directory that allows write access. The upper layer directory must be located in a filesystem that is mounted without using the 'nosuid' flag.\n
The modification time for the suid file in the FUSE partition is changed using the touch utility, which results in its copying to the upper layer of OverlayFS.\n
When copying, the kernel does not remove the setgid\/setuid flags, causing the file to appear in a partition that allows processing of setgid\/setuid.\n
To gain root privileges, it is sufficient to execute the file with setgid\/setuid flags from the directory attached to the upper layer of OverlayFS. <\/ul>\n
Additionally, it's worth noting that researchers from the Google Project Zero team disclosed details about three vulnerabilities that were fixed in the main branch of the Linux kernel 5.15 but were not backported to the kernel packages from RHEL 8.x\/9.x and CentOS Stream 9. <\/p>\n
\n
CVE-2023-1252 \u2014 access to an already freed memory area in the ovl_aio_req structure when conducting multiple operations simultaneously on OverlayFS deployed over an Ext4 filesystem. The vulnerability potentially allows users to elevate their privileges in the system.\n
CVE-2023-0590 \u2014 access to an already freed memory area in the qdisc_graft() function. It is presumed that exploitation is limited to causing a crash.\n
CVE-2023-1249 \u2014 access to an already freed memory area in the coredump write code, arising from a missed mmap_lock call in file_files_note. It is presumed that exploitation is limited to causing a crash. <\/ul>\n