CVE-2021-3493: Linux Kernel Privilege Escalation Vulnerability
Vulnerability summary
CVE-2021-3493 is a high (CVSS 8.8) Privilege Context Switching Error vulnerability in Linux Kernel. It is known to be exploited: CISA lists it, first on 20-10-2022. EPSS estimates a 49.17% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities. 3 public exploits are recorded.
Listed as exploited by CISA (20-10-2022)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 17-04-2021PublishedVulnerability first disclosed.
- 20-10-2022Added to CISA KEVExploitedLinux Kernel Privilege Escalation Vulnerability
- 10-11-2022CISA remediation dueDeadline passedApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
49.17%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 49.17% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 20-10-2022
- Federal due date
- 10-11-2022
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
CISA required action
Apply updates per vendor instructions. git.kernel.org/pub/… nvd.nist.gov/vuln/detail/CVE-2021-3493
Public exploits
3 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
2021 Ubuntu Overlayfs LPE
exploit/linux/local/cve_2021_3493_overlayfs
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-270Privilege Context Switching ErrorThe product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu51 products
- linux< 4.4.0-209.241 | < 4.15.0-142.146 | < 5.4.0-72.80
- linux-aws< 4.4.0-1091.95 | < 4.4.0-1127.141 | < 4.15.0-1099.106 | < 5.4.0-1045.47
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3All versions (No fix recorded)
- linux-aws-5.4< 5.4.0-1045.47~18.04.1
Canonical1 product
- ubuntu_linux< 18.04 | ≥ 18.04.1, < 20.04 | < 20.10
Debian1 product
- linux< 5.10.38-1
3 vendors · 53 products
References
13 links- www.openwall.com/lists/oss-security/2021/04/16/1X Refsource MISCREPORTMailing ListThird Party Advisory
- packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.htmlX Refsource MISCPress/Media CoverageThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3493Government ResourceUS Government Resource
