{"id":"CVE-2023-0386","kind":"vulnerability","aliases":["CVE-2023-0386"],"related":[],"title":"A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with…","description":"Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"A flaw in the Linux kernel's OverlayFS lets a local user copy a file with capabilities from a nosuid mount into another mount and gain elevated privileges. An attacker with a local shell gets root-level privileges on the machine.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2025-06-17T00:00:00+00:00","products":[{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"netapp h300s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h500s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h700s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h410s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h410c firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 18.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 20.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 22.04","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.15.91"],"affected":">= 5.11, < 5.15.91","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.1.9"],"affected":">= 5.16, < 6.1.9","ecosystem":"vendor"},{"name":"linux kernel","fixed":[],"affected":"= 6.2","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kubernetes","linux","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Update to a patched Linux kernel from your distribution; the sources do not name the fixed versions.","status":"open","published_at":"2023-03-22T21:15:18+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:54+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:46:54Z","model":"claude-haiku-5-5","output":{"fix":"Update to a patched Linux kernel from your distribution; the sources do not name the fixed versions.\nunknown","reach":"local","summary":"A flaw in the Linux kernel's OverlayFS lets a local user copy a file with capabilities from a nosuid mount into another mount and gain elevated privileges. An attacker with a local shell gets root-level privileges on the machine.","category":"infrastructure","who_cares":["linux","self-hosted","kubernetes"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains root privileges on the host system","analyst_note":"Find affected and fixed kernel versions and the OverlayFS exposure check (e.g. whether unprivileged overlay mounts are enabled) at the CISA KEV entry and the upstream kernel advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000434,"input_tokens":2589,"output_tokens":350,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':179C '-0386':21A,24A '-2023':20A,23A '22':178C 'access':11A,118C 'action':169C 'allow':156C 'anoth':88B,150C 'appli':170C 'applic':176C 'attack':95B 'bod':177C 'bug':155C 'canonical':42A,45A,48A 'capabl':82B,127C,143C 'cisa':167C 'cloud':182C 'contain':110C 'copi':78B,141C 'cve':19A,22A 'debian':25A 'discontinu':185C 'elev':92B 'escal':161C 'execut':14A,121C 'exploit':59B 'file':18A,80B,125C,144C 'firmware':29A,32A,35A,38A,41A 'flaw':2A,67B 'follow':175C 'found':4A,129C 'gain':91B 'get':100B 'guidanc':180C 'h300s':28A 'h410c':40A 'h410s':37A 'h500s':31A 'h700s':34A 'host':65B 'improp':112C 'infrastructur':60B 'instruct':174C 'kernel':8A,52A,54A,56A,58A,71B,109C,133C 'kubernet':61B 'let':74B 'level':103B 'linux':7A,26A,44A,47A,50A,51A,53A,55A,57A,62B,70B,108C,132C 'local':76B,98B,158C 'machin':107B 'manag':114C 'map':154C 'mitig':171C,191C 'mount':86B,89B,148C,151C 'netapp':27A,30A,33A,36A,39A 'nosuid':85B,147C 'overlayf':73B,135C 'ownership':113C 'per':172C 'privileg':93B,104B,163C 'product':189C 'requir':168C 'root':102B 'root-level':101B 'self':64B 'self-host':63B 'servic':183C 'setuid':17A,124C 'shell':99B 'subsystem':136C 'system':166C 'ubuntu':43A,46A,49A 'uid':153C 'unauthor':10A,117C 'unavail':193C 'use':186C 'user':77B,140C,159C 'vendor':173C 'vulner':115C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-03-22T21:15:18+00:00","kev":{"dateAdded":"2025-06-17","dueDate":"2025-07-08","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-0386","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-0386","severity":null,"published_at":"2025-06-17T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:40+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-0386","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0386","severity":null,"published_at":"2023-03-22T21:15:18+00:00","modified_at":"2026-06-17T05:25:25+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}