CVE-2023-2640

Katalog CVE

CVSS 7.8 · High EPSS 15,2%

Kerentanan Incorrect Authorization pada canonical ubuntu linux. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.

Rincian

Terbit di NVD

26 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

15,2% peluang dieksploitasi; lebih tinggi dari 96,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://ubuntu.com/security/notices/USN-6250-1 advisory vendor
• https://lists.ubuntu.com/archives/kernel-team/2023-July/140923.html mailing list · patch
• https://wiz.io/blog/ubuntu-overlayfs-vulnerability exploit · mitigasi · advisory pihak ketiga
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2640 advisory pihak ketiga