CVE-2023-2640 & CVE-2023-32629: Ubuntu Linux Kernel OverlayFS Privilege Escalation — Detection and Remediation Guide

---
title: Linux Kernel OverlayFS Privilege Escalation - SUID File Creation
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential local privilege escalation via OverlayFS vulnerabilities (CVE-2023-2640, CVE-2023-32629) by identifying SUID file creation in OverlayFS mount points
references:
  - https://ubuntu.com/security/notices/USN-8297-1
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2640
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32629
author: Security Arsenal
date: 2025/04/16
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2023.2640
  - cve.2023.32629
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetPath|contains:
      - '/overlay'
      - 'merged/'
      - 'upper/'
  filter_suid:
    mode|contains: 's'
  condition: selection and filter_suid
falsepositives:
  - Legitimate container operations (Docker, containerd)
  - Authorized system administration
level: high
---
title: Linux Kernel OverlayFS Exploit Patterns
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects execution of common exploit patterns associated with OverlayFS privilege escalation vulnerabilities
references:
  - https://ubuntu.com/security/notices/USN-8297-1
author: Security Arsenal
date: 2025/04/16
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2023.2640
  - cve.2023.32629
logsource:
  category: process_creation
  product: linux
detection:
  selection_compile:
    CommandLine|contains:
      - 'gcc -o'
      - 'cc -o'
  selection_temp:
    ImagePath|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  selection_overlay:
    CommandLine|contains:
      - 'overlay'
      - 'fuse'
  selection_chmod:
    CommandLine|contains:
      - 'chmod 4755'
      - 'chmod u+s'
  condition: (selection_compile and selection_temp) or (selection_overlay and selection_chmod)
falsepositives:
  - Legitimate software development
  - System administration testing
level: medium
---
title: Linux Kernel OverlayFS Mount from Suspicious Context
id: 3c4d5e6f-7a8b-9c0d-1e2f-3a4b5c6d7e8f
status: experimental
description: Detects OverlayFS mount operations from user-controlled directories that may indicate exploitation attempts
references:
  - https://ubuntu.com/security/notices/USN-8297-1
author: Security Arsenal
date: 2025/04/16
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2023.2640
  - cve.2023.32629
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ImagePath|endswith: '/bin/mount'
    CommandLine|contains: '-t overlay'
  context:
    CommandLine|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
      - '/home/'
  condition: selection and context
falsepositives:
  - Docker/container operations
  - User namespaces operations
level: medium

// Hunt for potential OverlayFS privilege escalation in Linux Syslog
let timeframe = 1d;
Syslog
| where TimeGenerated >= ago(timeframe)
| where SyslogMessage contains "overlay"
| where SyslogMessage contains "mount" 
   or SyslogMessage contains "chmod"
   or SyslogMessage contains "suid"
| project TimeGenerated, Computer, Facility, ProcessName, SyslogMessage
| order by TimeGenerated desc

-- Hunt for SUID files in OverlayFS mount points
SELECT FullPath, Mode, Size, Mtime, Atime, User.uid, User.name
FROM glob(globs=['/**/merged/**', '/**/upper/**'], accessor='auto')
WHERE Mode =~ 's'

#!/bin/bash
# Ubuntu Kernel Vulnerability Remediation Script
# Addresses USN-8297-1: CVE-2023-2640 and CVE-2023-32629

echo "Checking for Ubuntu kernel vulnerabilities..."
echo "Security Notice: USN-8297-1"
echo ""

# Check if running Ubuntu
if [ ! -f /etc/lsb-release ]; then
    echo "This system is not running Ubuntu. Exiting."
    exit 1
fi

# Get current Ubuntu version
. /etc/lsb-release
echo "Detected Ubuntu version: $DISTRIB_DESCRIPTION"
echo ""

# Check current kernel version
current_kernel=$(uname -r)
echo "Current kernel version: $current_kernel"
echo ""

# Check for OverlayFS mounts
echo "Checking for OverlayFS mounts..."
mount | grep overlay
echo ""

# Check for recent SUID files
echo "Checking for recently modified SUID files..."
find / -type f -perm -4000 -mtime -1 2>/dev/null | head -20
echo ""

# Apply security updates
echo "Applying security updates..."
sudo apt-get update

echo "Installing kernel security updates..."
sudo apt-get install -y linux-image-generic linux-headers-generic

echo ""
echo "For complete remediation details, visit:"
echo "https://ubuntu.com/security/notices/USN-8297-1"
echo ""
echo "Note: A system reboot is required to activate the new kernel."