CVE-2023-32629: Ubuntu Linux Privilege Escalation Flaw

CVE-2023-32629 Overview

CVE-2023-32629 is a local privilege escalation vulnerability affecting Ubuntu Linux kernels through the OverlayFS filesystem implementation. The vulnerability exists in the ovl_copy_up_meta_inode_data function, which improperly skips permission checks when calling ovl_do_setxattr on Ubuntu kernels. This flaw allows a local attacker with low privileges to escalate their privileges to root, potentially gaining complete control over the affected system.

Critical Impact

Local attackers can exploit this OverlayFS vulnerability to bypass permission checks and escalate privileges to root on affected Ubuntu systems, enabling full system compromise.

Affected Products

• Canonical Ubuntu Linux 23.04
• Ubuntu kernels with vulnerable OverlayFS implementation

Discovery Timeline

• July 26, 2023 - CVE-2023-32629 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-32629

Vulnerability Analysis

This vulnerability stems from improper authorization (CWE-863) in the Ubuntu kernel's OverlayFS implementation. OverlayFS is a union filesystem that allows layering of multiple directories, commonly used in container environments and system snapshots. The vulnerability specifically affects the copy-up operation, which is triggered when a file from the lower layer needs to be modified.

When a file undergoes copy-up in OverlayFS, the ovl_copy_up_meta_inode_data function is responsible for copying metadata, including extended attributes (xattrs). The vulnerable code path fails to properly verify that the calling process has sufficient permissions before invoking ovl_do_setxattr. This authorization bypass allows unprivileged users to manipulate extended attributes in ways that should require elevated privileges.

The local attack vector requires an authenticated user to have access to the target system. Once exploited, the attacker gains the ability to achieve high impact on confidentiality, integrity, and availability—effectively compromising the entire system.

Root Cause

The root cause of CVE-2023-32629 is improper authorization handling in the OverlayFS subsystem of Ubuntu kernels. Specifically, the ovl_copy_up_meta_inode_data function does not perform adequate permission checks before calling ovl_do_setxattr. This oversight allows operations that should be restricted to privileged users to be performed by any local user with access to an OverlayFS mount. The vulnerability is classified under CWE-863 (Incorrect Authorization), indicating a fundamental flaw in the access control logic.

Attack Vector

The attack requires local access to a system running an affected Ubuntu kernel with OverlayFS functionality available. An attacker would:

1. Mount or access an existing OverlayFS filesystem
2. Trigger a copy-up operation on a file from the lower layer
3. Exploit the missing permission checks to manipulate extended attributes
4. Leverage the manipulated attributes to escalate privileges to root

The exploitation does not require user interaction, making it a viable target for automated attacks once an attacker has local access to the system.

The vulnerability mechanism involves the OverlayFS copy-up process where metadata is transferred between filesystem layers. During this operation, the kernel fails to validate whether the calling process has appropriate permissions for extended attribute operations. Detailed technical analysis is available in the Wiz Blog Ubuntu OverlayFS Vulnerability report.

Detection Methods for CVE-2023-32629

Indicators of Compromise

• Unexpected privilege escalation events in system logs from low-privileged users
• Suspicious OverlayFS mount operations or unusual copy-up activity
• Modified extended attributes on files within OverlayFS mounts without corresponding authorized actions
• Anomalous process execution with elevated privileges following OverlayFS operations

Detection Strategies

• Monitor kernel audit logs for OverlayFS-related syscalls, particularly those involving setxattr operations
• Deploy file integrity monitoring on critical system directories that may be exposed through OverlayFS
• Implement runtime security solutions that can detect privilege escalation attempts at the kernel level
• Review container escape attempts that leverage OverlayFS, especially in Docker and Kubernetes environments

Monitoring Recommendations

• Enable auditd rules to log all extended attribute modifications: auditctl -a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr
• Monitor for processes spawning with unexpected UID changes following filesystem operations
• Track OverlayFS mount events and correlate with subsequent privilege changes
• Implement endpoint detection and response (EDR) solutions capable of detecting kernel-level exploitation

How to Mitigate CVE-2023-32629

Immediate Actions Required

• Apply Ubuntu security updates immediately, particularly those referenced in Ubuntu Security Notice USN-6250-1
• Restrict unprivileged user namespace creation if not required: sysctl -w kernel.unprivileged_userns_clone=0
• Limit access to OverlayFS functionality for non-essential users
• Review and audit existing OverlayFS mounts for potential misuse

Patch Information

Canonical has released security patches to address this vulnerability. The official security notice USN-6250-1 provides updated kernel packages that remediate the improper permission checks in the OverlayFS copy-up process. Additionally, Kernel Live Patch Security Notice LSN-0097-1 is available for systems using Ubuntu's Livepatch service, allowing patching without rebooting.

System administrators should update to the latest kernel version using apt update && apt upgrade and verify the kernel version matches the patched releases listed in the security notices.

Workarounds

• Disable unprivileged user namespaces to prevent exploitation in containerized environments
• Restrict OverlayFS mount capabilities using AppArmor or SELinux policies
• Implement network segmentation to limit lateral movement if a system is compromised
• Consider disabling OverlayFS module if not required: modprobe -r overlay (may impact container workloads)

# Disable unprivileged user namespaces as a temporary mitigation
echo "kernel.unprivileged_userns_clone=0" >> /etc/sysctl.conf
sysctl -p

# Verify current kernel version
uname -r

# Apply security updates
apt update && apt upgrade -y linux-image-generic

# Reboot to load patched kernel
systemctl reboot