Bug 1213685 (CVE-2023-32629)

Summary:	VUL-0: CVE-2023-32629: kernel-source,kernel-source-rt,kernel-source-azure: Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu kernel
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Gianluca Gabrielli <gianluca.gabrielli>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED INVALID	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	ddiss, meissner, security-team
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/373438/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-32629:7.8:(AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:
Bug Blocks:	1213707

Description Gianluca Gabrielli 2023-07-26 13:26:55 UTC

Local privilege escalation vulnerability in Ubuntu Kernels overlayfs
ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr
on Ubuntu kernels

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-32629
https://www.cve.org/CVERecord?id=CVE-2023-32629
https://lists.ubuntu.com/archives/kernel-team/2023-July/140920.html
https://ubuntu.com/security/notices/USN-6250-1
https://wiz.io/blog/ubuntu-overlayfs-vulnerability

Comment 1 Gianluca Gabrielli 2023-07-26 13:28:31 UTC

Hi kernel team,

even though the description of this security bug mention that only the Ubuntu kernel is vulnerable, I suspect that our branch cve/linux-5.3 might be vulnerable as well. Could you please double-check? In case it is, please submit the patch.

Comment 2 David Disseldorp 2023-07-26 13:56:43 UTC

(In reply to Gianluca Gabrielli from comment #1)
> Hi kernel team,
> 
> even though the description of this security bug mention that only the
> Ubuntu kernel is vulnerable, I suspect that our branch cve/linux-5.3 might
> be vulnerable as well. Could you please double-check? In case it is, please
> submit the patch.

Will take a look. Thanks for the report.

Comment 3 David Disseldorp 2023-07-27 10:32:02 UTC

The reports specify Ubuntu kernels because the privilege escalation requires "UBUNTU: SAUCE: overlayfs: Skip permission checking for
trusted.overlayfs.* xattrs" (alongside the mainline c914c0e27eb0).

We don't carry "UBUNTU: SAUCE: overlayfs: Skip permission checking for
trusted.overlayfs.* xattrs" in any branches, so aren't affected by this CVE.

Handing back to security team.

Comment 4 Gianluca Gabrielli 2023-07-27 12:04:03 UTC

Thank you very much for the analysis. Closing.