Step By Step Procedure To Fix The New Ubuntu Overlayfs Vulnerability (CVE-2021-3493)

You might have read that a new critical Ubuntu overlayfs vulnerability was discovered and registered under CVE-2021-3493 in mid-April 2021. This article covers not only information about the Ubuntu overlayfs vulnerability. It covers how to find the vulnerable host and how to fix the new Ubuntu overlayfs vulnerability (CVE-2021-3493) found on a vulnerable host.

Timeline Of This Vulnerability:

• An independent researcher reported this vulnerability in the early days of April 2021.
• On 12th April 2021, the vulnerability was registered in National Vulnerability Database (NVD) under CVE-2021-3493.
• Ubuntu published this vulnerability with security advisories on 15th April 2021.

About The New Ubuntu Overlayfs Vulnerability (CVE-2021-3493):

This is a new critical vulnerability that actually is not on the operating system, but it exists on the kernel of the operating system. The vulnerability is due to the overlayfs implementation in the Linux kernel, which did not properly validate the application of file system capabilities with respect to use namespaces. A local user can use this Ubuntu overlayfs vulnerability to gain root privileges without authentication.

Ubuntu Versions Vulnerable To New Ubuntu Overlayfs Vulnerability (CVE-2021-3493):

This is a Ubuntu-specific vulnerability. This could be seen on some Debian distros too. Other popular Linux distributions: RedHat and Suse confirmed that the vulnerability doesn’t exist on their distros. Few reference links are shared here below.

• Ubuntu 20.10
• Ubuntu 20.04 LTS
• Ubuntu 18.04 LTS
• Ubuntu 16.04 LTS
• Ubuntu 14.04 ESM

• https://ubuntu.com/security/CVE-2021-3493
• https://security-tracker.debian.org/tracker/CVE-2021-3493
• https://www.suse.com/security/cve/CVE-2021-3493/
• https://access.redhat.com/security/cve/CVE-2021-3493

Technical Details Of The New Ubuntu Overlayfs Vulnerability (CVE-2021-3493)

Linux supports file capabilities stored in extended file attributes that work similarly to setuid-bit but can be more fine-grained. A simplified procedure for setting file capabilities in pseudo-code looks like this:

setxattr(…):
if cap_convert_nscap(…) is not OK:
then fail
vfs_setxattr(…)

The important call is cap_convert_nscap, which checks permissions with respect to namespaces.

If we set the file capabilities from our own namespace and on our own mount, there is no problem, and we have permission to do so. The problem is that when OverlayFS forwards this operation to the underlying file system, it only calls vfs_setxattr and skips checks in cap_convert_nscap.

This allows setting arbitrary capabilities on files in the outer namespace/mount, where they will also be applied during execution.

In Linux 5.11, the call to cap_convert_nscap was moved into vfs_setxattr, so it is no more vulnerable.

How To Test The New Ubuntu Overlayfs Vulnerability (CVE-2021-3493) On The Host?

1. Check the version of the kernel running on your Ubuntu server. Open the terminal and issue this command to check the version of Ubuntu:

$ cat /etc/os-release

in our case, we are running 20.04 LTS which is vulnerable to Ubuntu overlayfs vulnerability (CVE-2021-3493)

2. The exploit is available for public in GitHub. Download the exploit and execute. We have downloaded the exploit on the desktop for demonstration purpose.

Optional: You can verify the user with ‘whoami‘ command. In this case we are log in to a normal user account.

Change the directory to Desktop.
$ cd Desktop/CVE-2021-3493-main/

Set executable permission for ‘exploit.c‘ using ‘chmod’ command:
Enter the root password to execute the command.
$ sudo chmod +x exploit.c

First compel the ‘exploit.c’ file and store the compelled file to ‘execure.out‘ using a gcc compiler.
$ gcc exploit.c -o exploit

As soon as you execute the compelled file. You will see root command prompt without authentication.

This is how you can test the new Ubuntu overlayfs vulnerability (CVE-2021-3493) on the host.

How To Install Gcc Compiler On Ubuntu?

Gcc compiler is mandatory to have because the exploit is written in C language. Install the gcc compiler if not been installed on the host.
$ sudo apt install gcc
In our case, we have the latest gcc package installed on our machine.

How To Fix The New Ubuntu Overlayfs Vulnerability (CVE-2021-3493) On The Host?

Ubuntu has issued the security advisory to fix this vulnerability. In this security advisory Ubuntu has fixed two vulnerabilities.
https://launchpad.net/ubuntu/+source/linux-oem-5.6

This is how you can fix the new Ubuntu overlayfs vulnerability (CVE-2021-3493) on the host.

Thanks for supporting our work. Please check in thesecmaster.com for more such tutorials.

• Step by step procedure to fix the new sudo vulnerability (CVE-2021-3156)
• How can FragAttacks vulnerabilities be exploited? & Possible workarounds
• How to quickly find and fix vulnerabilities on Windows in no time?
• Step by step procedure to detect the Microsoft Exchange 0 Day exploit.
• Microsoft Exchange 0 Day cyberattack explained:
• Explore the Android File system hierarchy in-depth: