inspiringz / cve-2021-3493

CVE-2021-3493 Ubuntu OverlayFS Local Privesc (Interactive Bash Shell & Execute Command Entered)

CVE-2021-3493

Ubuntu OverlayFS Local Privesc

Description

"Ubuntu specific issue in the overlayfs file system in the Linux kernel where it did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges, due to a patch carried in Ubuntu to allow unprivileged overlayfs mounts." - Ubuntu Security

Fixed in Linux 5.11

Affected Versions

• Ubuntu 20.10
• Ubuntu 20.04 LTS
• Ubuntu 19.04 LTS
• Ubuntu 18.04 LTS
• Ubuntu 16.04 LTS
• Ubuntu 14.04 ESM

checklist: https://ubuntu.com/security/CVE-2021-3493

Usage

• gcc exploit.c -o exploit
• chmod +x exploit
• ./exploit shell|command

References

• https://github.com/briskets/CVE-2021-3493

cve-2021-3493's Issues

Permissions getting changed to the user - nobody and the group - nogroup after getting a root shell

Apparently I get a root shell and it says I'm root. The users and the group names of all the files are getting changed to nobody and nogroup respectively. That is why none of the files that were owned by root prior to the priv esc doesn't cat out post becoming root after the exploitation.