CVE-2021-3847
Description
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a file with capabilities from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.
Mitigation
The mitigation is to mount overlayfs with nosuid if lower layer is nosuid.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.7 | 7.8 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | High | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | High | High | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
The privileges required High (PR:H), because "mount: only root can use "--options" option" (so regular user cannot run command like "mount -t overlay overlay -o lowerdir=/lower,upperdir=/upper,workdir=/work /merged" if without root or some other root-like privileges). For the case when inserting USB device that this bug about unlikely that auto-mount could happen for OverlayFS too. However, there is other more or less similar CVE-2023-0386 about OverlayFS subsystem where actually PR:L.
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Application Data; Modify Application Data
Acknowledgements
Red Hat would like to thank Alon Zahavi (CyberArk) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
