CVE-2023-0386
Linux Kernel Improper Ownership Management Vulnerability
CVSS
—
Sin CVSS
EPSS
7.9%
p95
KEV
SÍ
17 jun 2025
Exploit Today
78
0-100
Publicado: — · Última mod.: —
Producto
Linux / Kernel
Vulnerabilidad
Linux Kernel Improper Ownership Management Vulnerability
Añadido a KEV
17 jun 2025
Remediar antes de
8 jul 2025
Uso conocido en ransomware
No
Descripción resumida
Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
Acción requerida
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notas
This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a ; https://access.redhat.com/security/cve/cve-2023-0386 ; https://security.netapp.com/advisory/ntap-20230420-0004/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-0386