CVE-2023-32629: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2023-32629 is a local privilege escalation vulnerability discovered in the Ubuntu Linux kernel's OverlayFS implementation. The vulnerability was discovered by Shir Tamari and Sagi Tzadik and disclosed in June 2023. The issue affects Ubuntu kernels where overlayfs ovlcopyupmetainodedata skips permission checks when calling ovldo_setxattr. This vulnerability has a CVSS score of 7.8 (High) (Ubuntu Security, NVD).

The vulnerability exists in the OverlayFS module, which is a union filesystem that allows one filesystem to be overlaid on top of another. The issue stems from Ubuntu's modifications to the OverlayFS module, specifically in the ovldosetxattr function which calls _vfssetxattrnoperm directly instead of vfssetxattr. This implementation fails to properly convert file security capabilities to limit them to a user namespace before copying them to the upper directory. The vulnerability can be triggered when mounting OverlayFS with metacopy=on, where only file metadata is copied instead of the entire file (Wiz Blog).

The vulnerability allows local attackers to gain elevated privileges on affected systems. When successfully exploited, an attacker can escalate privileges to root level, potentially gaining complete control over the system. The vulnerability affects approximately 40% of Ubuntu cloud workloads and is particularly concerning because existing exploits for previous OverlayFS vulnerabilities can be used without modification (Wiz Blog).

Ubuntu has released patches for affected versions. If immediate patching is not possible, a workaround is available by disabling unprivileged user namespace creation. This can be done temporarily using 'sudo sysctl -w kernel.unprivilegedusernsclone=0' or permanently by adding the setting to /etc/sysctl.d/99-disable-unpriv-userns.conf. Users are strongly advised to update their kernels to the latest version (Ubuntu Security, Wiz Blog).

The vulnerability has garnered significant attention due to its wide impact on Ubuntu systems and its ease of exploitation. Security researchers have dubbed it 'GameOver(lay)' along with its companion vulnerability CVE-2023-2640, highlighting the serious nature of these security flaws. The discovery also sparked discussions about the risks of modifying complex open-source projects, as Ubuntu's initial kernel modifications appeared harmless but became problematic after subsequent Linux kernel changes (Wiz Blog).