CVE-2023-32629

What it actually does

Local privilege escalation via skipped permission checks in overlayfs ovl_copy_up_meta_inode_data when invoking ovl_do_setxattr.

Why it matters to the business

Attackers with local access can obtain full root privileges on affected systems, leading to complete compromise of data and operations; weaponized exploit increases urgency despite declining EPSS trend.

How an attack unfolds

A local attacker sets up a malicious overlay filesystem to trigger the vulnerable code path, bypassing permission checks during metadata copy-up to set arbitrary extended attributes and escalate privileges.

How to fix it

Apply kernel updates addressing the overlayfs flaw; for affected pkp/pkp-lib deployments update to commit 44d8bde60eb2575fd4087b76540aec9b49389e23.

How to confirm the fix worked

Verify kernel version post-update contains the overlayfs permission check fix and test that ovl_copy_up_meta_inode_data enforces expected xattr restrictions.

Typical attack path

1. Obtain local user access on target system
2. Create or mount a crafted overlayfs instance
3. Trigger ovl_copy_up_meta_inode_data via file operations
4. Exploit skipped checks in ovl_do_setxattr to modify attributes
5. Escalate to root and execute arbitrary code

How to detect it

Review system logs for unusual overlayfs xattr operations or unexpected privilege changes by local processes; examine audit trails for setxattr calls bypassing expected checks.

What your security team should do

• Prioritize patching Ubuntu kernels on all systems with local user access
• Monitor for local privilege escalation attempts until patches are deployed
• Restrict untrusted local accounts where possible