CVE-2021-3493 · netVigilance record NV22-0527

Linux Kernel Privilege Escalation

past due

What to do

Apply updates per vendor instructions.

CISA deadline 2022-11-10 · passed 3 years 9 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA

What happened

The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.

Who is affected

Linux Kernel. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.

Weakness class: CWE-862.

Timeline

2022-10-20
Added to CISA KEVExploitation in the wild confirmed by CISA
2022-11-10
CISA remediation deadlinepassed 3 years 9 months ago

Sources

NVD entry for CVE-2021-3493 nvd.nist.gov/vuln/detail/CVE-2021-3493
CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
git.kernel.org git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52
nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2021-3493