CVE-2021-3493
Description
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
Summary dbcve.org
The overlayfs implementation in the Linux kernel failed to properly validate user namespaces when setting file capabilities on files in an underlying file system. Combined with Ubuntu's kernel patch allowing unprivileged overlay mounts, this allowed local attackers to gain elevated privileges.
Mitigation
Apply the upstream kernel patch and consider restricting or disabling unprivileged user namespaces if not required, or upgrade to a patched kernel version.