# GameOver(lay): Easy-to-exploit local privilege escalation vulnerabilities in Ubuntu Linux affect 40% of Ubuntu cloud workloads

Ubuntu's OverlayFS modifications let unprivileged users copy scoped file capabilities unscoped to the upper layer, yielding root via crafted executables.

- Payout: Research
- Severity: high
- Program: Ubuntu Linux
- Credited: Wiz Research
- Disclosed: 2023-07-27
- CVE: CVE-2023-2640, CVE-2023-32629
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ubuntu-overlayfs-vulnerability
- Tags: domain:infra domain:oss impact:privesc kind:research platform:threat-intel sev:high tech:linux technique:chained technique:incomplete-fix technique:source-review vuln:privilege-escalation

**Target:** Linux kernel OverlayFS module (ovl_copy_xattr, ovl_copy_up_meta_inode_data)
**Root cause:** Ubuntu's ovl_do_setxattr calls __vfs_setxattr_noperm instead of vfs_setxattr, skipping cap_convert_nscap so file capabilities are copied without namespace scoping.
**Steps:**
1. `unshare -rm bash` to enter user+mount namespace
2. `setcap cap_sys_admin +eip lower/suid` on an executable in the lower dir
3. `mount -t overlay overlay -o rw,lowerdir=lower,upperdir=upper,workdir=workdir mount`
4. `touch mount/suid` to trigger copy-up of the file with xattrs
5. `getcap lower/suid` shows unscoped cap_dac_override,cap_sys_admin+eip outside namespace
6. For CVE-2023-32629: mount with `metacopy=on`, modify metadata to create skeleton file with capabilities, then touch mount point to copy content into skeleton
**How found:** Reviewed the CVE-2023-0386 patch restricting file creation to the user namespace; hypothesized file capabilities could bypass the SUID restriction, tested on Ubuntu and confirmed capabilities persisted after copy-up; then grepped for unsafe ovl_do_setxattr flows to find the metacopy variant.
**Exploitation:** Attacker with local code execution creates a user namespace, sets scoped file capabilities on an executable in the lower layer, mounts OverlayFS, and triggers copy-up so the kernel writes an unscoped-capability executable to the upper dir; executing it grants root-like privileges.
**Escalation:** Same exploit works unchanged for prior OverlayFS CVEs (CVE-2021-3493, CVE-2023-0386); affects ~40% of Ubuntu cloud workloads.
**Insight:** When a patch blocks one privilege primitive (SUID), check sibling primitives (file capabilities, xattrs) that share the same copy path; and grep distro-patched internal functions (__vfs_*) for missing security conversions that upstream vfs_* wrappers perform.