What is CVE-2023-2640?

CVE-2023-2640 is a high-severity vulnerability affecting systems running Canonical Ubuntu Linux 23.04 with specific kernel configurations. This security issue, found in the OverlayFS implementation, allows a local attacker to potentially gain elevated privileges. The vulnerability is particularly concerning as it impacts 40% of Ubuntu cloud workloads. Users are advised to update their systems to mitigate the risk posed by this easily exploitable vulnerability.

Who is impacted?

The CVE-2023-2640 vulnerability affects unprivileged users on systems running Canonical Ubuntu Linux 23.04 with specific kernel configurations. This security issue is found in the OverlayFS implementation and can potentially allow a local attacker to gain elevated privileges. The affected versions include Ubuntu 23.04 (Lunar Lobster) with version 6.2.0, Ubuntu 22.10 (Kinetic Kudu) with version 5.19.0, and Ubuntu 22.04 LTS (Jammy Jellyfish) with versions 5.19.0 and 6.2.0. It is important to note that this vulnerability impacts 40% of Ubuntu cloud workloads.

What to do if CVE-2023-2640 affected you

If you're affected by the CVE-2023-2640 vulnerability, it's crucial to take action to secure your system. Follow these simple steps to mitigate the risk:

1. Update your Ubuntu Linux system to the latest kernel version.

2. Monitor security announcements and updates from Ubuntu.

3. Consider restricting OverlayFS access to root users only.

Is it in CISA’s Known Exploited Vulnerabilities Catalog?

CVE-2023-2640, a high-severity vulnerability affecting Ubuntu Linux, is not listed in CISA's Known Exploited Vulnerabilities Catalog. This issue allows unprivileged users to potentially gain elevated privileges on affected systems. To mitigate the risk, users should update their Ubuntu Linux system to the latest kernel version, monitor security announcements from Ubuntu, and consider restricting OverlayFS access to root users only.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-863, which involves incorrect authorization in Ubuntu's OverlayFS implementation.

Learn More

CVE-2023-2640 is a high-severity vulnerability affecting Ubuntu Linux systems with specific kernel configurations, allowing unprivileged users to potentially gain elevated privileges. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• CVE - CVE-2023-2640

• [SRU Kinetic, Lunar, OEM-6.1 2/3] Revert "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs"

• USN-6250-1: Linux kernel vulnerabilities

• GameOver(lay): Easy-to-exploit local privilege escalation vulnerabilities in Ubuntu Linux affect 40% of Ubuntu cloud workloads