Vulnerable-Docker-Engine

CVE-2021-41091 이 익스플로잇은 CVE-2021-41091 보안 취약점에 대한 심층 분석을 제공하며, 호스트에서 권한 상승을 달성하기 위해 익스플로잇 스크립트를 활용하는 방법에 대한 단계별 가이드를 제공합니다. 취약점 요약 CVE-2021-41091은 MobyDocker Engine의 결함으로, 부적절하게 제한된 권한으로 인해 권한이 없는 Linux 사용자가 데이터 디렉터리일반적으로 /var/lib/docker에 위치를 탐색하고 프로그램을 실행할 수 있습니다. 이 취약점은 컨테이너에 setuid와 같은 확장 권한이 ...

CVE-2021-41091

CVE-2021-41091 이 익스플로잇은 CVE-2021-41091 보안 취약점에 대한 심층 분석을 제공하며, 호스트에서 권한 상승을 달성하기 위해 익스플로잇 스크립트를 활용하는 방법을 단계별로 안내합니다. 취약점 요약 CVE-2021-41091은 MobyDocker Engine의 결함으로, 부적절하게 제한된 권한으로 인해 권한이 없는 Linux 사용자가 데이터 디렉토리일반적으로 /var/lib/docker에 위치 내에서 프로그램을 탐색하고 실행할 수 있게 합니다. 이 취약점은 컨테이너에 setuid와 같은 확장된 권한이 있...

CVE-2023-0386

README gcc -Wall exp.c pkg-config fuse --cflags --libs -o exp ./exp /tmp 취약점 분석 이 문서의 이론적 지식네임스페이스, overlay 파일 시스템, fuse 파일 시스템 등은 모두 chatGPT에서 가져왔습니다. 취약점 개요 취약점 번호: CVE-2023-0386 취약점 제품: linux kernel - overlay 파일 시스템 영향 범위: 5.11 5.19 악용 조건: unshare를 실행할 수 있거나 overlay 파일 시스템을 생성할 수 있어야 함 악용 효과: ...

CVE-2023-0386-go-poc

CVE-2023-0386의 Go PoC ./main /tmp/fuse 프로그램을 실행하고 "/tmp/fuse" 디렉터리에 fuse 마운트를 생성합니다. 루트 디렉터리에 셸을 기본 이름인 "shell"로 컴파일했다고 가정합니다. 프로그램을 실행한 후에는 "/tmp/ovlmerged/" 디렉터리에 실행 가능한 바이너리가 있어야 하며, 이를 실행하면 루트 권한을 획득할 수 있습니다...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ovl: fixed the warning in ovlcreatereal Syzbot triggered the following warning in ovlworkdircreate - ovlcreatereal: if !err && WARNON!newdentry-d inode The reason is that the cgroup2 filesystem returns from mkdir without...

Astra Linux – Vulnerabilities in Linux-6.1, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerabilities have been resolved: ovl: Fixed a UAF Use-After-Free issue in ovldentryupdatereval by moving the dput function within ovllinkup. The issue arose because the dputupper function was called before ovldentryupdatereval, while upper-dflags was still...

Astra Linux – Vulnerability in Linux

Local privilege escalation vulnerability in Ubuntu Kernels overlayfs: Ovlcopyupmeta inodedata function skips permission checks when calling ohldosetxattr on Ubuntu kernels...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ovl: fixed null pointer dereference in ovlgetaclrcu The sequence of operations is as follows: P1 P2 pathopenat linkpathwalk maylookup inodepermissionrcu ovlpermission aclpermissioncheck checkacl getcachedaclrcu ovlget inodeacl...

Astra Linux – Vulnerability in Linux 6.1

On Ubuntu kernels that carry both c914c0e27eb0 and “UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs. xattrs”, a non-privileged user may set privileged extended attributes on mounted files, causing those attributes to be applied to the upper files without the appropriate...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A flaw was discovered in the Linux kernel, where unauthorized access to the execution of the setuid file with specific capabilities was detected within the OverlayFS subsystem of the Linux kernel. This issue occurs when a user copies a file with capabilities from a nosuid mount to another mount...

Astra Linux – Vulnerability in Linux, Linux 5.10

A race condition accessing file objects in the Linux kernel OverlayFS subsystem was identified. This occurs when users renames files using OverlayFS in a specific manner. A local user could exploit this flaw to cause the system to crash...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ovl: Use the “buf” flexible array as the destination for memcpy. The “buf” flexible array must be used as the destination for memcpy to avoid false positive run-time warnings caused by the recent FORTIFYSOURCE hardening measures:...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102056)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102056 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: get correct superblock from dentry in event btrfssyncfile If overlay is used ...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

Oracle Linux 9 : kernel (ELSA-2026-30848)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-30848 advisory. - RDMA/mlx5: Fix error path fall-through in mlx5ibdevressrqinit CKI Backport Bot RHEL-179994 CVE-2026-46176 - RDMA/vmwpvrdma: Fix double free on...

Linux Distros Unpatched Vulnerability : CVE-2026-53174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ovl: keep err zero after successful ovlcacheget ovliteratemerged stores PTRERRcache in err...

CVE-2026-53174

A flaw was found in the Linux kernel's overlay filesystem ovl component. Specifically, an issue in the ovliteratemerged function incorrectly stores an error pointer even after a successful cache operation. This can lead to the function returning a misleading non-zero error, potentially causing...

SUSE CVE-2026-53174

In the Linux kernel, the following vulnerability has been resolved: ovl: keep err zero after successful ovlcacheget ovliteratemerged stores PTRERRcache in err before checking ISERRcache. On success err holds the truncated cache pointer and can be returned as a bogus non-zero error. The syzbot...

UBUNTU-CVE-2026-53174

In the Linux kernel, the following vulnerability has been resolved: ovl: keep err zero after successful ovlcacheget ovliteratemerged stores PTRERRcache in err before checking ISERRcache. On success err holds the truncated cache pointer and can be returned as a bogus non-zero error. The syzbot...

EUVD-2026-39265

In the Linux kernel, the following vulnerability has been resolved: ovl: keep err zero after successful ovlcacheget ovliteratemerged stores PTRERRcache in err before checking ISERRcache. On success err holds the truncated cache pointer and can be returned as a bogus non-zero error. The syzbot...