CVE-2023-2640: Ubuntu Linux Privilege Escalation Flaw

CVE-2023-2640 Overview

CVE-2023-2640 is a privilege escalation vulnerability in the Ubuntu Linux kernel's OverlayFS implementation. The flaw exists in Ubuntu-specific kernel patches that skip permission checking for trusted.overlayfs.* extended attributes (xattrs). An unprivileged local user can set privileged extended attributes on files in an OverlayFS mount, and those attributes propagate to upper files without the required security checks. This results in local privilege escalation to root on affected Ubuntu systems. The vulnerability is tracked under CWE-863: Incorrect Authorization and affects Ubuntu kernels carrying both commit c914c0e27eb0 and the UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs patch.

Critical Impact
A local unprivileged attacker can escalate to root by setting privileged extended attributes on OverlayFS-mounted files, bypassing standard capability checks.

Affected Products

Canonical Ubuntu Linux 23.04 (Lunar Lobster) kernels
Ubuntu Linux 22.10 and earlier supported releases carrying the affected SAUCE patch
Ubuntu kernel builds containing both c914c0e27eb0 and the trusted.overlayfs.* xattr skip patch

Discovery Timeline

2023-07-26 - CVE-2023-2640 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-2640

Vulnerability Analysis

The vulnerability resides in Ubuntu's custom OverlayFS code path. OverlayFS is a union mount filesystem that stacks an upper writable layer over a lower read-only layer. Ubuntu carries a SAUCE patch titled UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs that bypasses capability checks when handling extended attributes in the trusted.overlayfs namespace.

When combined with upstream commit c914c0e27eb0, which changes how OverlayFS handles file copy-up operations, the result is that an unprivileged user can set trusted.* extended attributes on files within an OverlayFS mount. These attributes are normally restricted to processes with CAP_SYS_ADMIN. Attackers can leverage this to assign attributes such as security.capability, granting binaries elevated capabilities including cap_setuid for direct root escalation.

Root Cause

The root cause is improper authorization [CWE-863] in the Ubuntu-specific OverlayFS xattr handling path. The SAUCE patch was intended to allow OverlayFS internal metadata to bypass permission checks, but the implementation allowed unprivileged users to also set privileged trusted.* xattrs. Permission validation that should enforce CAP_SYS_ADMIN for trusted xattrs is skipped, and the attributes propagate to the upper-layer file with their privileged effects intact.

Attack Vector

Exploitation requires local access and a low-privileged user account. The attacker creates an OverlayFS mount in a user namespace, places a target file in the lower layer, sets a crafted security.capability xattr through the OverlayFS-specific code path, and triggers copy-up. The resulting upper file inherits the capability attribute. Executing the binary yields elevated privileges. The Wiz Research team published a detailed exploit walkthrough demonstrating root escalation. See the Wiz Blog OverlayFS Vulnerability Analysis for the full technical breakdown.

Detection Methods for CVE-2023-2640

Indicators of Compromise

Unexpected security.capability extended attributes on user-writable binaries, especially in directories accessible by non-root users
New OverlayFS mounts created by unprivileged processes within user namespaces
setxattr syscalls targeting trusted.overlayfs.* or security.capability namespaces from unprivileged UIDs
Setuid-like behavior from binaries that were not previously privileged

Detection Strategies

Monitor setxattr and fsetxattr syscalls via auditd or eBPF for non-root callers writing to trusted.* or security.* namespaces
Audit mount and unshare syscalls for OverlayFS mounts created inside user namespaces by unprivileged users
Baseline filesystem state and alert on capability attributes appearing on unexpected executables
Correlate process execution with prior xattr modifications to identify exploitation chains

Monitoring Recommendations

Enable Linux audit rules for setxattr, mount, and unshare syscalls and forward logs to a centralized analytics platform
Track kernel version inventory across the Ubuntu fleet and flag hosts running affected linux-image packages
Alert on shell or root execution following recent xattr operations by the same UID
Review container runtime events for unexpected OverlayFS mount activity outside container engines

How to Mitigate CVE-2023-2640

Immediate Actions Required

Apply the Ubuntu kernel updates referenced in Ubuntu Security Notice USN-6250-1 and reboot affected systems
Inventory all Ubuntu hosts to identify kernels containing the vulnerable SAUCE patch
Restrict creation of user namespaces by unprivileged users where business requirements permit
Audit user-writable binaries for unauthorized security.capability attributes and remove any that are not legitimate

Patch Information

Canonical released fixed kernel packages in USN-6250-1. Refer to the Ubuntu Kernel Team Archive for the upstream patch discussion. Update via apt update && apt upgrade and reboot to load the patched kernel image.

Workarounds

Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 via sysctl until the kernel patch can be applied
Restrict OverlayFS mount capabilities using AppArmor or seccomp profiles for untrusted workloads
Apply auditd rules to detect and alert on trusted.overlayfs.* xattr operations by unprivileged users

bash

# Configuration example
# Disable unprivileged user namespaces as a temporary workaround
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-cve-2023-2640.conf

# Verify installed kernel after applying USN-6250-1
uname -r
apt list --installed 2>/dev/null | grep linux-image

# Audit rule to log setxattr calls on trusted namespace
sudo auditctl -a always,exit -F arch=b64 -S setxattr -S fsetxattr -k cve-2023-2640