Bug 1213685 (CVE-2023-32629) - VUL-0: CVE-2023-32629: kernel-source,kernel-source-rt,kernel-source-azure: Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu kernel
Summary: VUL-0: CVE-2023-32629: kernel-source,kernel-source-rt,kernel-source-azure: Lo...
Status: RESOLVED INVALID
Alias: CVE-2023-32629
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/373438/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-32629:7.8:(AV:...
Keywords:
Depends on:
Blocks: 1213707
  Show dependency tree / graph
 
Reported: 2023-07-26 13:26 UTC by Gianluca Gabrielli
Modified: 2023-07-27 12:04 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Gianluca Gabrielli 2023-07-26 13:26:55 UTC 
Local privilege escalation vulnerability in Ubuntu Kernels overlayfs
ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr
on Ubuntu kernels

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-32629
https://www.cve.org/CVERecord?id=CVE-2023-32629
https://lists.ubuntu.com/archives/kernel-team/2023-July/140920.html
https://ubuntu.com/security/notices/USN-6250-1
https://wiz.io/blog/ubuntu-overlayfs-vulnerability
Comment 1 Gianluca Gabrielli 2023-07-26 13:28:31 UTC 
Hi kernel team,

even though the description of this security bug mention that only the Ubuntu kernel is vulnerable, I suspect that our branch cve/linux-5.3 might be vulnerable as well. Could you please double-check? In case it is, please submit the patch.
Comment 2 David Disseldorp 2023-07-26 13:56:43 UTC 
(In reply to Gianluca Gabrielli from comment #1)
> Hi kernel team,
> 
> even though the description of this security bug mention that only the
> Ubuntu kernel is vulnerable, I suspect that our branch cve/linux-5.3 might
> be vulnerable as well. Could you please double-check? In case it is, please
> submit the patch.

Will take a look. Thanks for the report.
Comment 3 David Disseldorp 2023-07-27 10:32:02 UTC 
The reports specify Ubuntu kernels because the privilege escalation requires "UBUNTU: SAUCE: overlayfs: Skip permission checking for
trusted.overlayfs.* xattrs" (alongside the mainline c914c0e27eb0).

We don't carry "UBUNTU: SAUCE: overlayfs: Skip permission checking for
trusted.overlayfs.* xattrs" in any branches, so aren't affected by this CVE.

Handing back to security team.
Comment 4 Gianluca Gabrielli 2023-07-27 12:04:03 UTC 
Thank you very much for the analysis. Closing.