● CVE-2023-2640 / GameOver(lay)

CVE-2023-2640: Ubuntu OverlayFS Privilege Escalation Teardown (GameOver(lay))

How Ubuntu-specific modifications to OverlayFS skipped permission checks during inode copy-up, allowing unprivileged containers to forge root setuid binaries.

💡 Простое объяснение на пальцах (ELI5)

Imagine a photocopier at a library that has a rule: 'Customers cannot photocopy official government stamps with valid signatures'. But the library technicians modified their specific copy machine to make copying faster, accidentally skipping the rule. A student photocopies an empty hall pass with a forged presidential signature, and walks out as the commander-in-chief.

Ключевые концепции и архитектурные термины

OverlayFS: A union mount filesystem combining an underlying read-only layer (lowerdir) with a writable upper layer (upperdir).
Inode Copy-Up: The process where a file in the lower layer is duplicated into the upper writable layer upon modification.
Extended Attributes (xattr): Filesystem metadata used to store security capabilities such as `security.capability` (`cap_setuid`).
User Namespace Mapping: Mapping unprivileged container UIDs (e.g. 1000) to fake root inside a sandbox while remaining unprivileged on the host.

Пошаговая механика выполнения атаки

Step 1

1. Spawn User Namespace

The attacker creates a user namespace and mounts an OverlayFS filesystem.

Step 2

2. Craft File with Fake Capabilities

Inside the namespace, the attacker sets security.capability to cap_setuid on a binary.

Step 3

3. Trigger OverlayFS Copy-Up

The attacker touches the file, causing Ubuntu's custom OverlayFS to copy the file to the host upperdir.

Step 4

4. Host Privilege Escalation

Because Ubuntu skipped security checks, the file lands on the host disk with REAL root setuid capabilities.

Исходный код: Уязвимость vs. Исправленный патч

Представлено на понятном высокоуровневом исходном коде (без ассемблера и бинарных дампов).

УЯЗВИМЫЙ КОД ДО ПАТЧА

// VULNERABLE: fs/overlayfs/copy_up.c (Ubuntu kernel custom patch)
int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c, struct dentry *dentry) {
    // ROOT CAUSE:
    // Ubuntu used raw __vfs_setxattr_noperm() instead of vfs_setxattr()!
    // This completely BYPASSED all security and user-namespace capability validations!
    err = __vfs_setxattr_noperm(&init_user_ns, c->new_dentry, 
                                XATTR_NAME_CAPS, value, size, 0);
    return err;
}

БЕЗОПАСНОЕ ИСПРАВЛЕНИЕ

// SECURE: fs/overlayfs/copy_up.c after security fix
int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c, struct dentry *dentry) {
    // 1. Enforce strict capability namespace mapping checks
    // Verifies whether the calling user has genuine authority over target capabilities
    err = vfs_setxattr(ovl_dentry_user_ns(dentry), c->new_dentry,
                       XATTR_NAME_CAPS, value, size, 0);
    if (err) {
        return err; // Rejects unprivileged capability copy-up!
    }
    return 0;
}

Инженерный чек-лист для код-ревью и защиты систем

Never bypass filesystem permission checks using `__vfs_setxattr_noperm` without strict caller credentials validation.
Avoid maintaining downstream vendor-specific kernel filesystem patches that override upstream security models.
Verify that container storage drivers properly translate file capabilities across namespace boundaries.
Monitor unexpected root setuid binary creation using auditd or Falco.

← Полный каталог уязвимостей Все бюллетени безопасности →