CVE-2021-3493
CVE-2021-3493 is a high-severity vulnerability in Canonical Ubuntu Linux with a CVSS 3.x base score of 8.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2022-10-20). The underlying weakness is classified as CWE-863.
Key facts
- Severity: High (CVSS 3.x base score 8.8)
- CVSS v2: 7.2
- EPSS exploit prediction: 44% (99th percentile)
- Actively exploited: Yes — listed in CISA KEV (added 2022-10-20)
- EU (EUVD) id: EUVD-2021-26815
- EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2022-10-20)
- Weakness: CWE-863
- Affected product: Canonical Ubuntu Linux
- Published:
- Last modified:
Description
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
Frequently asked questions
- What is CVE-2021-3493?
- The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
- How severe is CVE-2021-3493?
- CVE-2021-3493 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2021-3493 being actively exploited?
- Yes. CVE-2021-3493 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2022-10-20, which means active exploitation has been confirmed. It should be prioritised for remediation.
- What products are affected by CVE-2021-3493?
- CVE-2021-3493 primarily affects Canonical Ubuntu Linux. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2021-3493?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
- Does CVE-2021-3493 have an EU (EUVD) identifier?
- Yes. CVE-2021-3493 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2021-26815. It is also flagged as exploited in the EUVD (since 2022-10-20).
- When was CVE-2021-3493 published?
- CVE-2021-3493 was published on 2021-04-17 and last updated on 2026-06-17.
References
- http://packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.html
- http://packetstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52
- https://ubuntu.com/security/notices/USN-4917-1
- https://www.openwall.com/lists/oss-security/2021/04/16/1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3493
Affected products (2)
- cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:-:*:*:*
More vulnerabilities in Canonical Ubuntu Linux
- CVE-2023-1523 — Critical (CVSS 10.0): Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal…
- CVE-2020-13753 — Critical (CVSS 10.0): The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER…
- CVE-2018-18505 — Critical (CVSS 10.0): An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to…
- CVE-2017-16845 — Critical (CVSS 10.0): hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds…
- CVE-2016-0494 — Critical (CVSS 10.0): Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and…
- CVE-2016-0483 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows…
All CVEs affecting Canonical Ubuntu Linux →
Other CWE-863 (Incorrect Authorization) vulnerabilities
- CVE-2026-48286 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization…
- CVE-2026-48303 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization…
- CVE-2026-44330 — Critical (CVSS 10.0): free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the…
- CVE-2026-46595 — Critical (CVSS 10.0): Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
- CVE-2026-33105 — Critical (CVSS 10.0): Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over…
- CVE-2026-32213 — Critical (CVSS 10.0): Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
Browse all CWE-863 (Incorrect Authorization) vulnerabilities →