GameOver(lay): Two Severe Linux Vulnerabilities Impact 40% of Ubuntu Users

Cybersecurity scientists have disclosed two higher-severity security flaws in the Ubuntu kernel that could pave the way for neighborhood privilege escalation attacks.

Cloud security firm Wiz, in a report shared with The Hacker News, claimed the effortless-to-exploit shortcomings have the probable to effects 40% of Ubuntu people.

“The impacted Ubuntu variations are widespread in the cloud as they provide as the default running units for a number of [cloud service providers],” security researchers Sagi Tzadik and Shir Tamari mentioned.

The vulnerabilities – tracked as CVE-2023-32629 and 2023-2640 (CVSS scores: 7.8) and dubbed GameOver(lay) – are current in a module referred to as OverlayFS and arise as a outcome of inadequate permissions checks in specific scenarios, enabling a area attacker to attain elevated privileges.

Overlay Filesystem refers to a union mount file procedure that makes it possible to incorporate several listing trees or file devices into a solitary, unified filesystem.

A transient description of the two flaws is under –

• CVE-2023-2640 – On Ubuntu kernels carrying both of those c914c0e27eb0 and “UBUNTU: SAUCE: overlayfs: Skip permission examining for dependable.overlayfs.* xattrs,” an unprivileged user may established privileged prolonged characteristics on the mounted files, primary them to be established on the higher data files without the appropriate security checks.
• CVE-2023-32629 – Neighborhood privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_duplicate_up_meta_inode_facts skip authorization checks when contacting ovl_do_setxattr on Ubuntu kernels

In a nutshell, GameOver(lay) tends to make it possible to “craft an executable file with scoped file abilities and trick the Ubuntu Kernel into copying it to a distinct

Approaching WEBINARShield Towards Insider Threats: Learn SaaS Security Posture Management

Apprehensive about insider threats? We’ve bought you lined! Be a part of this webinar to explore practical strategies and the techniques of proactive security with SaaS Security Posture Administration.

Join Nowadays

site with unscoped abilities, granting any one who executes it root-like privileges.”

Following responsible disclosure, the vulnerabilities have been mounted by Ubuntu as of July 24, 2023.

The results underscore the actuality that delicate modifications in the Linux kernel released by Ubuntu could have unforeseen implications, Wiz CTO and co-founder Ami Luttwak reported in a assertion shared with the publication.

“Equally vulnerabilities are one of a kind to Ubuntu kernels given that they stemmed from Ubuntu’s individual adjustments to the OverlayFS module,” the scientists claimed, introducing the issues are comparable to other vulnerabilities this sort of as CVE-2016-1576, CVE-2021-3493, CVE-2021-3847, and CVE-2023-0386.

Discovered this article interesting? Abide by us on Twitter  and LinkedIn to go through far more unique material we article.

Some parts of this article are sourced from:
thehackernews.com