CVE-2023-0386 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2023-03-22

Added to CISA KEV: 2025-06-17 818 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for unusual privilege escalation activities, check for unauthorized root access, verify system integrity
URGENT: Update Linux kernel to patched versions (6.2-rc6 and later have fixes)
Monitor for unusual file operations involving OverlayFS mounts and capability changes
Review user access logs for signs of privilege escalation attempts
Consider disabling OverlayFS if not required for operations
Implement additional monitoring for setuid file operations and capability changes

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2023-0386 is a local privilege escalation vulnerability within the Linux kernel's OverlayFS subsystem ^[1] ^[6]. It has been confirmed as a vulnerability actively targeted by threat actors and is included in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog ^[2].

Exploitation and Attack Details

Attack Method: The vulnerability stems from improper handling of file ownership and capabilities during "copy-up" operations in the OverlayFS subsystem ^[1] ^[6]. Specifically, when a user copies a file with capabilities from a `nosuid` mount to another mount, the kernel fails to properly strip these capabilities, allowing them to be preserved incorrectly ^[1] ^[5].
Requirements: This is a local vulnerability, meaning an attacker must already have some level of access to the system to initiate the exploit ^[1] ^[4]. No specific user interaction is required beyond the attacker executing the exploit code locally.
Impact: Successful exploitation allows a local user to escalate their privileges, typically gaining root access to the affected system ^[2] ^[6].
PoC Availability: Multiple proof-of-concept (PoC) exploits were made publicly available on GitHub shortly after the vulnerability's disclosure in May 2023, which significantly lowered the barrier for exploitation ^[3] ^[4].

Affected Versions and Mitigation

Affected Versions: The vulnerability affects Linux kernel versions from 5.11 through 6.1.8 (excluding 5.15.91) ^[1].
Patch Status: The issue was patched in the Linux kernel in January 2023 ^[4]. Users are strongly advised to update their kernels to a version containing the fix to mitigate the risk of privilege escalation ^[3] ^[7].

Sources