CVERadar
HIGH · CVSS 3.1 7.8CISA KEV · added 2025-06-17Metasploit modulePublic PoCEPSS 7.88% (p95)Threat level 56

CVE-2023-0386: Linux Kernel Improper Ownership Management Vulnerability

Linux · Kernel · NVD published 2023-03-23 · posted 2025-06-17 · last modified 2026-06-17

What it is

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

WeaknessCWE-282
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (source: [email protected])
CISA due date2025-07-08 (for US federal agencies under BOD; a good deadline for everyone)
ATT&CK tacticsPersistence → Privilege Escalation → Stealth

Exploitation evidence

First exploit evidence seen: 2023-03-22 (earliest date across the sources below).

Exploited in the wild

  • CISA KEV: listed since 2025-06-17. Source

Public exploit code

Metasploit

GitHub proof-of-concept repositories

18 public repositories from 18 accounts, first seen 2023-04-20. Most starred: xkaneiki/CVE-2023-0386 (416 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: CISA KEV · Rapid7 Metasploit Framework module metadata · nomi-sec/PoC-in-GitHub.

Defend the Chain

The attack chain for CVE-2023-0386 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.

Threat level 56/100
Defender level 1 · 0 XP
Chain links broken: 0/3

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Stealth

Defense Impairment

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Pick a red technique card on the board, then choose the defence that stops it.

Defend against T1543 Create or Modify System Process CTID: primary impact

Linux kernel's OverlayFS contains a privilege escalation vulnerability that allows a local user with no privileges to obtain root-level privileges.

How to fix it

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)

Fixed versions

  • linux linux kernel: upgrade to 5.15.91 or later (affected from 5.11)
  • linux linux kernel: upgrade to 6.1.9 or later (affected from 5.16)

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

MITRE ATT&CK mitigations for this chain

  • M1018 User Account Management (for T1543) : Limit privileges of user accounts and groups so that only authorized administrators can interact with system-level process changes and service configurations.
  • M1040 Behavior Prevention on Endpoint (for T1543, T1055.012) : On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent an application from writing a signed vulnerable driver to the system. On Windows 10 and 11, enable Microsoft Vulnerable Driver Blocklist to assist in hardening against third party-developed drivers.
  • M1033 Limit Software Installation (for T1543) : Restrict software installation to trusted repositories only and be cautious of orphaned software packages.
  • M1026 Privileged Account Management (for T1543) : Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
  • M1028 Operating System Configuration (for T1543, T1548.001) : Ensure that Driver Signature Enforcement is enabled to restrict unsigned drivers from being installed.
  • M1047 Audit (for T1543) : Use auditing tools capable of detecting privilege and service abuse opportunities on systems within an enterprise and correct them.
  • M1054 Software Configuration (for T1543) : Where possible, consider enforcing the use of container services in rootless mode to limit the possibility of privilege escalation or malicious effects on the host running the container.
  • M1022 Restrict File and Directory Permissions (for T1543) : Restrict read/write access to system-level process files to only select privileged users who have a legitimate need to manage system services.
  • M1045 Code Signing (for T1543) : Enforce registration and execution of only legitimately signed service drivers where possible.

Detection Generic guidance

  • Persistence: Look for new files in web roots, new scheduled tasks/services, and new accounts created after the exposure window.
  • Privilege Escalation: Alert on processes gaining SYSTEM/root unexpectedly, and on exploitation crashes of privileged services.

Response checklist Generic guidance

  1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
  2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
  3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
  4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.

Sources