CVE-2023-2640

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Canonical	Ubuntu Kernel	—
canonical	ubantu_kernel	< 6.2.0-26.26; < 6.0.0-1020.20; < 5.4.0-155.172

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2640Third Party Advisory
https://lists.ubuntu.com/archives/kernel-team/2023-July/140923.htmlMailing List, Patch
https://ubuntu.com/security/notices/USN-6250-1Vendor Advisory
https://wiz.io/blog/ubuntu-overlayfs-vulnerabilityExploit, Mitigation, Third Party Advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2640Third Party Advisory
https://lists.ubuntu.com/archives/kernel-team/2023-July/140923.htmlMailing List, Patch
https://ubuntu.com/security/notices/USN-6250-1Vendor Advisory
https://wiz.io/blog/ubuntu-overlayfs-vulnerabilityExploit, Mitigation, Third Party Advisory

Timeline

Published: Jul 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-264005.5Adobe Dimension version 3.4.8 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive me CVE-2023-264015.5Adobe Dimension version 3.4.8 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive me CVE-2023-264027.8Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which CVE-2023-264035.5Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of se CVE-2023-264045.5Adobe Dimension version 3.4.8 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive me CVE-2023-264057.8Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Input Validation vulnera CVE-2023-264067.8Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerabi CVE-2023-264077.8Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Input Validation vulnera CVE-2023-264087.8Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerabi CVE-2023-264097.8Adobe Substance 3D Designer version 12.4.0 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, whi CVE-2023-26419.8A vulnerability was found in SourceCodester Online Internship Management System 1.0. It has been rated as critical. Affected by this issue i CVE-2023-264107.8Adobe Substance 3D Designer version 12.4.0 (and earlier) is affected by a Use After Free vulnerability that could result in arbitrary code e