CVE-2021-3493

KEVLinux Kernel Privilege Escalation Vulnerability

Description

The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

PublishedApr 17, 2021

Last modifiedJun 17, 2026

Added to KEVOct 20, 2022

Remediation dueNov 10, 2022

References

packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.htmlExploitThird Party Advisory
packetstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.htmlPress/Media CoverageThird Party Advisory
packetstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.htmlExploitThird Party Advisory
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52Mailing ListPatch
ubuntu.com/security/notices/USN-4917-1Vendor Advisory
openwall.com/lists/oss-security/2021/04/16/1Mailing ListThird Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3493US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1448 days
CVSS: 8.8 HIGH
EPSS (30-day exploit probability): 49.2% · top 1% of all CVEs
Weakness: CWE-270

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.