● CVE-2023-2640 / GameOver(lay)

CVE-2023-2640: Ubuntu OverlayFS Privilege Escalation Teardown (GameOver(lay))

How Ubuntu-specific modifications to OverlayFS skipped permission checks during inode copy-up, allowing unprivileged containers to forge root setuid binaries.

💡 비유를 통한 쉬운 설명 (ELI5)

Imagine a photocopier at a library that has a rule: 'Customers cannot photocopy official government stamps with valid signatures'. But the library technicians modified their specific copy machine to make copying faster, accidentally skipping the rule. A student photocopies an empty hall pass with a forged presidential signature, and walks out as the commander-in-chief.

핵심 개념 및 서브시스템 용어 해설

OverlayFS: A union mount filesystem combining an underlying read-only layer (lowerdir) with a writable upper layer (upperdir).
Inode Copy-Up: The process where a file in the lower layer is duplicated into the upper writable layer upon modification.
Extended Attributes (xattr): Filesystem metadata used to store security capabilities such as `security.capability` (`cap_setuid`).
User Namespace Mapping: Mapping unprivileged container UIDs (e.g. 1000) to fake root inside a sandbox while remaining unprivileged on the host.

단계별 공격 실행 메커니즘

Step 1

1. Spawn User Namespace

The attacker creates a user namespace and mounts an OverlayFS filesystem.

Step 2

2. Craft File with Fake Capabilities

Inside the namespace, the attacker sets security.capability to cap_setuid on a binary.

Step 3

3. Trigger OverlayFS Copy-Up

The attacker touches the file, causing Ubuntu's custom OverlayFS to copy the file to the host upperdir.

Step 4

4. Host Privilege Escalation

Because Ubuntu skipped security checks, the file lands on the host disk with REAL root setuid capabilities.

소스 코드 비교: 치명적 취약점 vs 보안 강화 패치

일반 개발자가 쉽게 이해할 수 있는 고수준 소스 코드로 제공 (어셈블리/바이너리 제외).

패치되지 않은 취약점

// VULNERABLE: fs/overlayfs/copy_up.c (Ubuntu kernel custom patch)
int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c, struct dentry *dentry) {
    // ROOT CAUSE:
    // Ubuntu used raw __vfs_setxattr_noperm() instead of vfs_setxattr()!
    // This completely BYPASSED all security and user-namespace capability validations!
    err = __vfs_setxattr_noperm(&init_user_ns, c->new_dentry, 
                                XATTR_NAME_CAPS, value, size, 0);
    return err;
}

보안 강화 패치

// SECURE: fs/overlayfs/copy_up.c after security fix
int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c, struct dentry *dentry) {
    // 1. Enforce strict capability namespace mapping checks
    // Verifies whether the calling user has genuine authority over target capabilities
    err = vfs_setxattr(ovl_dentry_user_ns(dentry), c->new_dentry,
                       XATTR_NAME_CAPS, value, size, 0);
    if (err) {
        return err; // Rejects unprivileged capability copy-up!
    }
    return 0;
}

엔지니어링 보안 강화 체크리스트

Never bypass filesystem permission checks using `__vfs_setxattr_noperm` without strict caller credentials validation.
Avoid maintaining downstream vendor-specific kernel filesystem patches that override upstream security models.
Verify that container storage drivers properly translate file capabilities across namespace boundaries.
Monitor unexpected root setuid binary creation using auditd or Falco.

← 전체 보안 디렉터리 보기 모든 플랫폼 보안 업데이트 →