Privilege Escalation in the Penguin Kingdom
- Javier Conejo del Cerro
- 18 jun
- 3 Min. de lectura
In June 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-0386 to its Known Exploited Vulnerabilities (KEV) catalog, confirming that the flaw is being actively abused in the wild. The vulnerability, which affects the Linux kernel’s OverlayFS subsystem, was first patched in early 2023, but systems running unpatched versions remain exposed. Rated 7.8 on the CVSS scale, this privilege escalation flaw allows local users to gain root access through improper UID mapping when copying capable files from a nosuid mount to another filesystem mount.
This escalation opens the door to system compromise and sensitive data exfiltration in enterprise, cloud, and containerized environments. While originally disclosed over a year ago, its reappearance in active attack chains underlines the persistent threat that overlooked Linux vulnerabilities can pose—even those that may seem “local only.”
Head and data in the clouds
The exploitation of CVE-2023-0386 primarily affects organizations and users operating Linux environments with local user access. This includes:
Enterprise and corporate systems where user segmentation and privilege boundaries are critical.
Multi-tenant cloud infrastructure where different users or services share underlying hardware.
CI/CD pipelines and shared development servers where temporary files and scripts are executed with automated privileges.
Containerized deployments in Kubernetes or Docker where privilege separation is essential to containment.
Administrators who rely on OverlayFS for performance or layered filesystem functionality may have unwittingly introduced a pathway for privilege escalation into their environment—especially if OverlayFS is configured with writable mounts accessible to non-root users.
Anatomy of a Breach
The flaw resides in the way the Linux kernel handles UID mapping when files with special capabilities are copied between mounts using OverlayFS. When a capable file (e.g., one with setuid permissions) is copied from a nosuid mount into another, the kernel fails to validate the file’s UID and capabilities in the target namespace. This oversight enables local users to:
Trick the kernel into creating a setuid binary owned by root in directories like /tmp.
Execute the binary to gain root-level privileges.
Access system credentials, configuration files, environment variables, and backend data.
The exploitation chain, while local in nature, is easily reproducible and has been described by researchers as “trivial to exploit.” It can serve as a second-stage vector following an initial compromise or be exploited by insider threats, making it a potent risk in environments that grant local access.
The vulnerability shares characteristics with two other OverlayFS-related flaws disclosed in 2023 (CVE-2023-32629 and CVE-2023-2640), collectively dubbed GameOver(lay), which allow similarly dangerous privilege escalations.
Patch Now, Audit Fast
While the vulnerability requires local access, its exploitation can lead to full system compromise and is now confirmed to be part of active attack chains. Administrators are strongly urged to take the following mitigation steps:
Apply the 2023 patch that fixes CVE-2023-0386 to all systems using vulnerable versions of the Linux kernel.
Audit the use of OverlayFS in all systems, especially those that allow user-generated scripts or access to writable mounts.
Restrict write permissions to mounts where OverlayFS is in use, avoiding configurations that allow users to interact with mount points that could be exploited.
Monitor temporary directories, particularly /tmp, for the sudden appearance of setuid binaries or unexpected files.
Limit local access to only trusted users and environments.
Review container and CI/CD configurations to ensure privilege boundaries are enforced and temp directories are locked down.
Apply the same hardening measures in forks, custom kernels, or embedded Linux environments where the upstream patch may not be present.
While U.S. Federal Civilian Executive Branch (FCEB) agencies are mandated to apply the patch before July 8, 2025, the urgency applies to all Linux users—whether managing massive enterprise deployments or single-user servers.
This vulnerability is a reminder that local flaws can become entry points in real-world attacks when defense-in-depth is neglected. Privilege boundaries matter, and kernel-level misconfigurations can silently undermine the entire security posture of a system.
Comments