● CVE-2023-2640 / GameOver(lay)

CVE-2023-2640: Ubuntu OverlayFS Privilege Escalation Teardown (GameOver(lay))

How Ubuntu-specific modifications to OverlayFS skipped permission checks during inode copy-up, allowing unprivileged containers to forge root setuid binaries.

💡 身近な例えで分かる解説 (ELI5)

Imagine a photocopier at a library that has a rule: 'Customers cannot photocopy official government stamps with valid signatures'. But the library technicians modified their specific copy machine to make copying faster, accidentally skipping the rule. A student photocopies an empty hall pass with a forged presidential signature, and walks out as the commander-in-chief.

中核となる概念とサブシステム用語

OverlayFS: A union mount filesystem combining an underlying read-only layer (lowerdir) with a writable upper layer (upperdir).
Inode Copy-Up: The process where a file in the lower layer is duplicated into the upper writable layer upon modification.
Extended Attributes (xattr): Filesystem metadata used to store security capabilities such as `security.capability` (`cap_setuid`).
User Namespace Mapping: Mapping unprivileged container UIDs (e.g. 1000) to fake root inside a sandbox while remaining unprivileged on the host.

ステップ別エクスプロイト実行メカニズム

Step 1

1. Spawn User Namespace

The attacker creates a user namespace and mounts an OverlayFS filesystem.

Step 2

2. Craft File with Fake Capabilities

Inside the namespace, the attacker sets security.capability to cap_setuid on a binary.

Step 3

3. Trigger OverlayFS Copy-Up

The attacker touches the file, causing Ubuntu's custom OverlayFS to copy the file to the host upperdir.

Step 4

4. Host Privilege Escalation

Because Ubuntu skipped security checks, the file lands on the host disk with REAL root setuid capabilities.

ソースコード比較：致命的バグ vs 安全な修正

日常的な開発者が直感的に理解できる高級言語コードで提示（バイナリやアセンブリ不使用）。

未修正の脆弱なコード

// VULNERABLE: fs/overlayfs/copy_up.c (Ubuntu kernel custom patch)
int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c, struct dentry *dentry) {
    // ROOT CAUSE:
    // Ubuntu used raw __vfs_setxattr_noperm() instead of vfs_setxattr()!
    // This completely BYPASSED all security and user-namespace capability validations!
    err = __vfs_setxattr_noperm(&init_user_ns, c->new_dentry, 
                                XATTR_NAME_CAPS, value, size, 0);
    return err;
}

修正済みの安全なコード

// SECURE: fs/overlayfs/copy_up.c after security fix
int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c, struct dentry *dentry) {
    // 1. Enforce strict capability namespace mapping checks
    // Verifies whether the calling user has genuine authority over target capabilities
    err = vfs_setxattr(ovl_dentry_user_ns(dentry), c->new_dentry,
                       XATTR_NAME_CAPS, value, size, 0);
    if (err) {
        return err; // Rejects unprivileged capability copy-up!
    }
    return 0;
}

開発現場向けシステム堅牢化チェックリスト

Never bypass filesystem permission checks using `__vfs_setxattr_noperm` without strict caller credentials validation.
Avoid maintaining downstream vendor-specific kernel filesystem patches that override upstream security models.
Verify that container storage drivers properly translate file capabilities across namespace boundaries.
Monitor unexpected root setuid binary creation using auditd or Falco.

← セキュリティディレクトリ一覧すべてのセキュリティ更新情報 →