Local Privilege Escalation Vulnerability in Ubuntu Kernels

CVE-2023-32629

What is CVE-2023-32629?

The local privilege escalation vulnerability in the overlayfs implementation of Ubuntu Kernels allows attackers to bypass permission checks during certain attribute-setting operations. Specifically, when invoking 'ovl_do_setxattr', the requisite permission checks are skipped, potentially leading to unauthorized access and manipulation of system resources. This issue could be exploited by local users to gain elevated privileges, thereby compromising system integrity and security.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-32629-CVE-2023-2640---POC-Escalation
Created by ThrynSec

Metasploit exploit module for CVE-2023-32629
Created by Rapid7

Check-for-CVE-2023-32629-GameOver-lay
Created by kaotickj

More PoCs...

News Articles

wiz.io

CVE-2023-32629CVE-2023-2640

GameOverlay Vulnerability Impacts 40% of Ubuntu Workloads | Wiz Blog

Wiz Research discovers CVE-2023-2640 & CVE-2023-32629, 2 privilege escalation vulnerabilities in Ubuntu's OverlayFS module impacting 40% of cloud workloads.

The Hacker News

CVE-2023-2640CVE-2023-32629

GameOver(lay): Two Severe Linux Vulnerabilities Impact 40% of Ubuntu Users

Cybersecurity researchers have uncovered high-severity flaws in the Ubuntu kernel, impacting 40% of users!

References