CyberSecBulletin
CVE-2023-0386Exploited in the wildNVD status: Analyzed

Linux Kernel Improper Ownership Management

Published Updated By the CyberSecBulletin desk

CVE-2023-0386 is a high-severity improper ownership management vulnerability in Kernel, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. Affected Kernel versions: Linux kernel 6.2-rc6. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on June 17, 2025, which means attacks have been observed in the wild.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Update Linux Kernel to 5.15.91 or 6.1.9, whichever matches your release line, or a later version.
  2. CISA's required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected products and versions

VendorProductAffected versionsFixed in
KernelKernelLinux kernel 6.2-rc6Not stated
DebianDebian Linux10.0Not stated
NetAppH300s FirmwareNot specified in the recordNot stated
NetAppH500s FirmwareNot specified in the recordNot stated
NetAppH700s FirmwareNot specified in the recordNot stated
NetAppH410s FirmwareNot specified in the recordNot stated
NetAppH410c FirmwareNot specified in the recordNot stated
CanonicalUbuntu Linux18.04; 20.04; 22.04Not stated
LinuxLinux Kernel5.11 up to, but not including, 5.15.91; 5.16 up to, but not including, 6.1.9; 6.25.15.91, 6.1.9

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighNVD
CVSS 3.17.8HighCISA (ADP)

Official description

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Ownership Management

The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.

How developers prevent this class of flaw

  • Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

More Improper Ownership Management vulnerabilities (CWE-282)

Timeline

  1. CVE record published.
  2. Added to CISA's Known Exploited Vulnerabilities catalogue.
  3. Deadline for US federal agencies to remediate, set by CISA.
  4. CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
  5. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Kernel

All Kernel vulnerabilities

Spotted an error? Tell us.