Linux Kernel Improper Ownership Management Vulnerability
Linux · Kernel
The flaw is an improper ownership management issue in the OverlayFS subsystem of the Linux kernel, where a setuid file with capabilities copied from a nosuid mount into another mount is not handled correctly due to a uid mapping bug. A local user with low privileges and no user interaction can exploit it to gain unauthorized execution of the setuid file with capabilities and escalate their privileges on the system.
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 2/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
What they do
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 2 years after disclosure. Public exploit code (Metasploit) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
2 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 2PersistenceTA0003
Linux kernel's OverlayFS contains a privilege escalation vulnerability that allows a local user with no privileges to obtain root-level privileges.
Privilege EscalationTA0004
Lower-confidence links (1)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Process HollowingT1055.012 Windows-only technique on a non-Windows product
Detection
0 rules for this CVE · 11 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2023-0386 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Setuid and SetgidT1548.0012 general rules
- PwnKit Local Privilege Escalationhightest
- Setuid and Setgidlowtest
Create or Modify System ProcessT15439 general rules
- CodeIntegrity - Blocked Driver Load With Revoked Certificatehightest
- CodeIntegrity - Blocked Image/Driver Load For Policy Violationhightest
- KrbRelayUp Service Installationhightest
- PUA - Process Hacker Driver Loadhightest
- Service Installed By Unusual Client - Securityhightest
- Service Installed By Unusual Client - Systemhightest
- PUA - Process Hacker Executionmediumtest
- PUA - System Informer Driver Loadmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX