CVE-2023-2640

What it actually does

Bypasses permission checks allowing unprivileged local users to set privileged extended attributes (trusted.overlayfs.*) on overlayfs mounted files without security validation, causing them to apply to upper files.

Why it matters to the business

Enables local attackers to escalate privileges on affected systems, risking full compromise; weaponized exploit available increases urgency despite no KEV listing or ransomware use.

How an attack unfolds

Local unprivileged attacker mounts overlayfs and directly sets trusted xattrs that skip checks due to the combined patches, allowing privileged attributes to persist on upper-layer files for further abuse.

How to fix it

Upgrade pkp/pkp-lib (GIT) to commit 4d77a00be9050fac7eb8d2d1cbedcdaaa1a5a803; apply equivalent kernel patches removing the SAUCE overlayfs xattr skip logic.

How to confirm the fix worked

Confirm the fixed commit or patched kernel is deployed; test that setxattr calls for trusted.overlayfs attributes are rejected for unprivileged users on mounted overlayfs.

Typical attack path

1. Obtain local unprivileged shell access
2. Mount an overlayfs filesystem
3. Use setxattr to apply trusted.overlayfs.* attributes bypassing checks
4. Leverage resulting privileged files for escalation or persistence

How to detect it

Review audit logs and kernel logs for unusual setxattr calls involving trusted.overlayfs attributes on overlayfs mounts; correlate with local user activity.

What your security team should do

• Prioritize patching all affected systems within standard change windows given weaponized exploit maturity
• Audit systems for overlayfs usage and restrict local unprivileged access where possible
• Update detection rules to watch for anomalous xattr modifications