← Back

CVE-2023-0386

nvd nist
Published: Mar 22, 2023Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

Affected (16)

Show all products
Debian: Debian Linux · Netapp: H300s Firmware, H500s Firmware, H700s Firmware, H410s Firmware, H410c Firmware · Canonical: Ubuntu Linux · Linux: Linux Kernel
Debian
1 product
Debian Linux
Netapp
5 products
H300s Firmware
H500s Firmware
H700s Firmware
H410s Firmware
H410c Firmware
Canonical
1 product
Ubuntu Linux
Linux
1 product
Linux Kernel
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 10.0
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H300s Firmware
All versions
Running on/withPlatform Versions
Netapp
H300s
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H500s Firmware
All versions
Running on/withPlatform Versions
Netapp
H500s
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H700s Firmware
All versions
Running on/withPlatform Versions
Netapp
H700s
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H410s Firmware
All versions
Running on/withPlatform Versions
Netapp
H410s
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H410c Firmware
All versions
Running on/withPlatform Versions
Netapp
H410c
All versions
Configuration G
3 vulnerable
Vulnerable SoftwareAffected Versions
Canonical
Ubuntu Linux
Version 18.04
Ubuntu Linux
Version 20.04
Ubuntu Linux
Version 22.04
Configuration H
7 vulnerable
Vulnerable SoftwareAffected Versions
Linux
Linux Kernel
5.11 ≤ version < 5.15.91
Linux Kernel
5.16 ≤ version < 6.1.9
Linux Kernel
Version 6.2 rc1
Linux Kernel
Version 6.2 rc2
Linux Kernel
Version 6.2 rc3
Linux Kernel
Version 6.2 rc4
Linux Kernel
Version 6.2 rc5

Related CWEs

CWE-282
Improper Ownership Management
The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.

References (13)

Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Broken LinkMailing ListPatchVendor Advisory
Source: secalert@redhat.com
Mailing ListThird Party Advisory
Source: secalert@redhat.com
Mailing ListThird Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkMailing ListPatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.