{"id":"CVE-2021-3493","kind":"vulnerability","aliases":["CVE-2021-3493"],"related":[],"title":"canonical ubuntu linux: The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the…","description":"The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.","summary":"The overlayfs file system in the Linux kernel does not properly check file capabilities against user namespaces. A local user can gain root privileges on the machine.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2022-10-20T00:00:00+00:00","products":[{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":["18.04"],"affected":"< 18.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":["20.04"],"affected":">= 18.04.1, < 20.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":["20.10"],"affected":"< 20.10","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kubernetes","linux","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the kernel update from your Linux distribution vendor; CISA says to apply updates per vendor instructions.","status":"open","published_at":"2021-04-17T05:15:14+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:29+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:10:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply the kernel update from your Linux distribution vendor; CISA says to apply updates per vendor instructions.","reach":"local","impact":"high","summary":"The overlayfs file system in the Linux kernel does not properly check file capabilities against user namespaces. A local user can gain root privileges on the machine.","category":"infrastructure","who_cares":["linux","self-hosted","kubernetes"],"confidence":0.7,"needs_auth":"yes","worst_case":"local user gains root privileges on the host machine","analyst_note":"Find the affected kernel version ranges and distro patch list from the vendor advisories for CVE-2021-3493 and confirm whether overlayfs in user namespaces is on by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000438,"input_tokens":2786,"output_tokens":318,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':21A,24A '-3493':22A,25A 'allow':117C 'along':107C 'attack':122C 'canon':1A 'canonical':28A,31A,34A 'capabl':57B,91C 'carri':111C 'check':55B 'combin':102C 'could':123C 'cve':20A,23A 'due':99C 'elev':128C 'exploit':37B 'file':46B,56B,90C,93C,97C 'gain':65B,127C 'host':43B 'implement':6A,73C 'infrastructur':38B 'kernel':10A,27A,51B,77C,115C 'kubernet':39B 'linux':3A,9A,26A,30A,33A,36A,40B,50B,76C 'local':62B 'machin':70B 'mount':120C 'namespac':19A,60B,86C,106C 'overlay':119C 'overlayf':5A,45B,72C 'patch':110C 'privileg':67B,129C 'proper':13A,54B,80C 'respect':16A,83C 'root':66B 'self':42B 'self-host':41B 'set':88C 'system':47B,98C 'ubuntu':2A,29A,32A,35A,114C 'under':96C 'unprivileg':104C,118C 'use':124C 'user':18A,59B,63B,85C,105C 'valid':14A,81C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-04-17T05:15:14+00:00","kev":{"dateAdded":"2022-10-20","dueDate":"2022-11-10","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@ubuntu.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-3493","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-3493","severity":null,"published_at":"2022-10-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T12:39:23+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-3493","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3493","severity":null,"published_at":"2021-04-17T05:15:14+00:00","modified_at":"2026-06-17T04:05:12+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}