Security readout for executives and security teams
Plain-English summary
CVE-2023-0386 is a Linux kernel privilege-escalation flaw in OverlayFS. A local low-privileged user could gain higher privileges by abusing how a capable setuid file is copied from a nosuid mount. This is not described as remote unauthenticated access, but CISA KEV lists it as known exploited.
Executive priority
Prioritize remediation because this is a known-exploited local privilege-escalation issue in a core operating system component. It is most urgent on shared Linux systems and systems where attackers may already have limited access.
Technical view
The flaw is a UID mapping authorization bug in Linux OverlayFS involving capable setuid files moved from a nosuid mount into another mount. The CVSS 3.1 score is 7.8, with local attack vector, low complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most relevant on Linux systems running affected kernel builds or vendor kernels covered by the listed Debian, NetApp, or kernel advisories, where an untrusted local user or process can execute code.
Exploitation context
Active exploitation is supported by the CISA Known Exploited Vulnerabilities listing. The provided evidence describes local privilege escalation, so initial local code execution or an account is still required before this bug is useful.
Researcher notes
Evidence supports CWE-282 improper authorization in OverlayFS UID mapping behavior. The source bundle identifies Linux kernel 6.2-rc6 and references upstream commit 4f11ada10d0a, Debian fixes, NetApp guidance, and CISA KEV. Product/version impact beyond those sources should not be inferred.
Mitigation direction
- Apply vendor kernel updates that include the upstream OverlayFS fix.
- For Debian systems, follow DSA-5402 and applicable LTS advisories.
- For NetApp environments, check the NetApp advisory for product-specific status.
- Reduce untrusted local access until affected kernels are remediated.
- Reboot or otherwise activate the fixed kernel after updating.
Validation and detection
- Inventory Linux kernel versions across servers and appliances.
- Compare installed kernels against Debian, NetApp, and upstream advisory coverage.
- Confirm patched kernels are actually running after maintenance.
- Review systems with untrusted local users or workloads first.
- Track CISA KEV due dates where they apply to your organization.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-282: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-0386 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0aCVE reference
- https://security.netapp.com/advisory/ntap-20230420-0004/CVE reference
- DSA-5402CVE reference · vendor-advisory
- [debian-lts-announce] 20230605 [SECURITY] [DLA 3446-1] linux-5.10 security updateCVE reference · mailing-list
- [debian-lts-announce] 20240627 [SECURITY] [DLA 3840-1] linux security updateCVE reference · mailing-list
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0386CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Ownership Management
Improper Ownership Management represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.