HPI-VDB — Database for IT-Attack Analysis


ID: CVE-2023-0386

Last Modified: March 27, 2023

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

Twitter Activity

Tweets last week: 0

Remaining steady

Yahoo Activity

Yahoo results: 370000

Strongly raising

EPSS History

Current EPSS Score: 0.00042

Remaining steady

Reddit Activity

Reddit Posts: 6

Remaining steady

Github Repos

Github Repos: 0

Remaining steady

Exploits

Found exploits:

Attack Vector: Local

Attack Complexity: Low

Privileges Required: Low

User Interaction: None

Scope: Unchanged

Confidentiality: High

Integrity: High

Availability: High

Base Score: 7.8

Exploitability Score: 1.8

Impact Score: 5.9

CVSS V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Specialize CVSS-Score

NVD-CWE-Other

Condition Configuration
OR
OR
Alle Schwachstellen für linux
Alle Schwachstellen für linux
Alle Schwachstellen für linux
Alle Schwachstellen für linux
Alle Schwachstellen für linux
Alle Schwachstellen für linux
Date: March 27, 2023

CWE-ID: Not defined
Base Score V3: Not defined
Exploitability Score V3: Not defined
Impact Score V3: Not defined
Cvss Vector V3: Not defined
Configuration:
added:
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*


Date: April 20, 2023

Reference:
added:
https://security.netapp.com/advisory/ntap-20230420-0004/


Date: May 14, 2023

Reference:
added:
https://www.debian.org/security/2023/dsa-5402


Date: June 5, 2023

Reference:
added:
https://lists.debian.org/debian-lts-announce/2023/06/msg00008.html


Date: June 22, 2023

Reference:
added:
http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html


                    <?xml version="1.0" ?>
<set operator="and">
    <set operator="or">
        <prop key="operating_system" value="cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"/>
        <prop key="operating_system" value="cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*"/>
        <prop key="operating_system" value="cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*"/>
        <prop key="operating_system" value="cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*"/>
        <prop key="operating_system" value="cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*"/>
        <prop key="operating_system" value="cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*"/>
    </set>
</set>

                  
                      <?xml version="1.0" ?>
<set operator="and">
    <set operator="or">
        <prop key="operating_system" value="cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"/>
        <prop key="operating_system" value="cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*"/>
        <prop key="operating_system" value="cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*"/>
        <prop key="operating_system" value="cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*"/>
        <prop key="operating_system" value="cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*"/>
        <prop key="operating_system" value="cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*"/>
    </set>
    <prop key="program_influence" value="input"/>
</set>