High severity · published Apr 17, 2021
CVE-2021-3493
Linux Kernel Privilege Escalation Vulnerability
In wildKEV
7.8
CVSS
49.2%
EPSS
Yes
On KEV
Description
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)49.2% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 20, 2022
Federal remediation dueNov 10, 2022
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
All versions, or not specified · source: KEV
LK
linux kernel · Ubuntu
5.8 kernel before 5.8.0-50.56; 5.4 kernel before 5.4.0-72.80; 4.15 kernel before 4.15.0-142.146; 4.4 kernel before 4.4.0-209.241 · source: vendor
UL
Ubuntu Linux · Canonical
before 18.04; 18.04.1 before 20.04; before 20.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3493
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3493
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://ubuntu.com/security/notices/USN-4917-1
x_refsource_MISC
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52
x_refsource_MISC
https://www.openwall.com/lists/oss-security/2021/04/16/1
x_refsource_MISC
http://packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.html
x_refsource_MISC
http://packetstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.html
x_refsource_MISC
http://packetstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.html
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability