CVE-2021-3847
published 2022-04-01CVE-2021-3847: An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.45%
36.6th percentile
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | — | — |
| fedoraproject | fedora | — | — |
| linux | linux_kernel | <= 5.17.0 | — |
| linux | linux_kernel | — | — |
| msrc | cbl2_kernel_5.15.160.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | cm1_kernel_5.10.189.1-1_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into anot
vendor_msrc·2022-04-12·CVSS 7.8
CVE-2021-3847 [HIGH] CWE-281 An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into anot
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post f
Red Hat
kernel: low-privileged user privileges escalation
vendor_redhat·2021-09-13·CVSS 7.8
CVE-2021-3847 [HIGH] CWE-281 kernel: low-privileged user privileges escalation
kernel: low-privileged user privileges escalation
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a file with capabilities from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.
Mitigation: The mitigation is to mount overlayfs with nosuid if lower layer is nosuid.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: ker
Debian
CVE-2021-3847: linux - An unauthorized access to the execution of the setuid file with capabilities fla...
vendor_debian·2021·CVSS 7.8
CVE-2021-3847 [HIGH] CVE-2021-3847: linux - An unauthorized access to the execution of the setuid file with capabilities fla...
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
GHSA
GHSA-m6pr-c5vr-9466: An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user co
ghsa_unreviewed·2022-04-03
CVE-2021-3847 [HIGH] CWE-281 GHSA-m6pr-c5vr-9466: An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user co
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.
OSV
CVE-2021-3847: An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user co
osv·2022-04-01·CVSS 7.8
CVE-2021-3847 [HIGH] CVE-2021-3847: An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user co
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-0386 kernel: FUSE filesystem low-privileged user privileges escalation
bugzilla·2023-01-09·CVSS 7.8
CVE-2023-0386 [HIGH] CVE-2023-0386 kernel: FUSE filesystem low-privileged user privileges escalation
CVE-2023-0386 kernel: FUSE filesystem low-privileged user privileges escalation
An attacker with a low-privileged user on a Linux machine with an overlay mount which has a file capability in one of its layers may escalate his privileges up to root when copying a capable file from a nosuid mount into another mount. This vulnerability is similar to the CVE-2021-3847, but requires less permissions to run, so higher priority. The steps to reproduce:
1. Mount a FUSE filesystem that exposes a root owned setuid/setgid binary that is world writable.
2. unshare user/mount namespaces
3. mount an overlay with the FUSE fs as the lower dir, and a user writable upper dir (as usual). Make sure that the upper dir is on a filesystem that is not mounted with `nosuid`.
4. touch the file at the merged path
Bugzilla
CVE-2021-3847 kernel: low-privileged user privileges escalation
bugzilla·2021-10-01·CVSS 7.8
CVE-2021-3847 [HIGH] CVE-2021-3847 kernel: low-privileged user privileges escalation
CVE-2021-3847 kernel: low-privileged user privileges escalation
An attacker with a low-privileged user on a Linux machine with an overlay mount which has a file capability in one of its layers may escalate his privileges up to root when copying a capable file from a nosuid mount into another mount.
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 2014278]
Wiz
GameOverlay Vulnerability Impacts 40% of Ubuntu Workloads | Wiz Blog
blogs_wiz·2023-07-27·CVSS 7.8
CVE-2023-2640 [HIGH] GameOverlay Vulnerability Impacts 40% of Ubuntu Workloads | Wiz Blog
CVE-2023-2640 and CVE-2023-32629 were found in the OverlayFS module in Ubuntu, which is a widely used Linux filesystem that became highly popular with the rise of containers as its features enable the deployment of dynamic filesystems based on pre-built images. OverlayFS serves as an attractive attack surface as it has a history of numerous logical vulnerabilities that were easy to exploit. This makes the new discovered vulnerabilities especially risky given the exploits for the past OverlayFS vulnerabilities work out of the box without any changes.
The two vulnerabilities are exclusive to Ubuntu because Ubuntu introduced several changes to the OverlayFS module in 2018. These modifications did not pose any risks at the time. In 2020, a security vulnerability was discovered and patched in
Wiz
GameOverlay Vulnerability Impacts 40% of Ubuntu Workloads | Wiz Blog
blogs_wiz·2023-07-27·CVSS 7.8
CVE-2023-2640 [HIGH] GameOverlay Vulnerability Impacts 40% of Ubuntu Workloads | Wiz Blog
CVE-2023-2640 and CVE-2023-32629 were found in the OverlayFS module in Ubuntu, which is a widely used Linux filesystem that became highly popular with the rise of containers as its features enable the deployment of dynamic filesystems based on pre-built images. OverlayFS serves as an attractive attack surface as it has a history of numerous logical vulnerabilities that were easy to exploit. This makes the new discovered vulnerabilities especially risky given the exploits for the past OverlayFS vulnerabilities work out of the box without any changes.
The two vulnerabilities are exclusive to Ubuntu because Ubuntu introduced several changes to the OverlayFS module in 2018. These modifications did not pose any risks at the time. In 2020, a security vulnerability was discovered and patched in
2022-04-01
Published