# CVE-2023-2640

On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.

- Page: https://www.vulneraibility.com/cve/CVE-2023-2640
- CVSS: 7.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 15.20% (percentile 96.8)
- Public exploit code: 1 Metasploit module · 10 GitHub proofs of concept (first 2023-08-15)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2024-10-23)
- Weakness: CWE-863
- Published: 2023-07-26

## Affected

- canonical:ubuntu_linux

## References

- [advisory] https://ubuntu.com/security/notices/USN-6250-1
- [other] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2640
- [other] https://wiz.io/blog/ubuntu-overlayfs-vulnerability
- [other] https://lists.ubuntu.com/archives/kernel-team/2023-July/140923.html

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.