Read the docs
TI-2021-02452 Aliases CVE-2021-3493GHSA-2fj2-4h38-3c72

Incorrect authorization in Ubuntu linux kernel

Priority CRITICAL 97Exploited in the wildCWE-270Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

Why it matters now

Exploitation Active In CISA KEV since 2022-10-20CISA due date 2022-11-10
EPSS 0.49166 98th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed linux kernel (Ubuntu): 5.8.0-50.56, 5.4.0-72.80, 4.15.0-142.146 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Ubuntulinux kernel5.8 kernel to before 5.8.0-50.56; 5.4 kernel to before 5.4.0-72.80; 4.15 kernel to before 4.15.0-142.146; 4.4 kernel to before 4.4.0-209.2415.8.0-50.56, 5.4.0-72.80, 4.15.0-142.146, 4.4.0-209.241Patch availableCNA
  • linux kernel VendorUbuntu Affected 5.8 kernel to before 5.8.0-50.56; 5.4 kernel to before 5.4.0-72.80; 4.15 kernel to before 4.15.0-142.146; 4.4 kernel to before 4.4.0-209.241 Fixed in 5.8.0-50.56, 5.4.0-72.80, 4.15.0-142.146, 4.4.0-209.241 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:lts:*:*:*before 18.04; 18.04.1 to before 20.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:-:*:*:*before 20.10VulnerableCanonical
  • cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:lts:*:*:* Versions before 18.04; 18.04.1 to before 20.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:-:*:*:* Versions before 20.10 Vulnerable ·Canonical

Remediation

  • Fix · CNA linux kernel (Ubuntu) Fixed in 5.8.0-50.56, 5.4.0-72.80, 4.15.0-142.146, 4.4.0-209.241

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 5 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2022-10-20 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2021-3493
  3. 2026-10-03 Alias added: GHSA-2fj2-4h38-3c72

References

Exploit 2

Patch 1

Advisory 3

  • TI-2007-05153 Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD… CVSS 2.0HIGH 7.2
  • TI-2004-01032 Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and… CVSS 2.0HIGH 10.0
  • TI-2004-00896 Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other… CVSS 2.0HIGH 10.0
  • TI-2004-00800 Buffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may… CVSS 2.0HIGH 10.0
  • TI-2004-00962 Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to… CVSS 2.0HIGH 10.0
  • TI-2004-00806 Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code… CVSS 2.0HIGH 10.0
See all 129 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences