CVE-2021-3493

Aliases:UBUNTU-CVE-2021-3493DEBIAN-CVE-2021-3493
Advisory lineage Upstream: 0 Downstream: 6
Analyzed
Published: 17 Apr 2021, 04:20
Last modified:21 Oct 2025, 23:25

Vulnerability Summary

Overall Risk (default)
high
55/100
CVSS Score
8.8 HIGH
v3.1 (cve.org)
EPSS Score
49.17% HIGH
49% probability -27.60%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
3 found
Dark Web
Not detected

Timeline

17 Apr 2021, 04:20
Published
Vulnerability first disclosed
20 Oct 2022, 00:00
Added to CISA KEV
Linux Kernel Privilege Escalation Vulnerability
10 Nov 2022, 00:00
CISA Remediation Due
Apply updates per vendor instructions.
21 Oct 2025, 23:25
Last Modified
Vulnerability information updated

Description

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

CVSS Metrics

  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 7.2AV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 49.17%• Percentile: 99%

Techniques & Countermeasures

  • CWE-270•Privilege Context Switching Error

    The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.

  • CWE-863•Incorrect Authorization

    The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected Systems

  • canonical•ubuntu_linux

    < 18.04 | ≥ 18.04.1, < 20.04 | < 20.10

  • debian•linux

    < 5.10.38-1 | < 5.10.38-1 | < 5.10.38-1 | < 5.10.38-1

  • ubuntu•linux

    < 4.4.0-209.241 | < 4.15.0-142.146 | < 5.4.0-72.80

  • ubuntu•linux-aws

    < 4.4.0-1091.95 | < 4.4.0-1127.141 | < 4.15.0-1099.106 | < 5.4.0-1045.47

  • ubuntu•linux-aws-5.0

    all

  • ubuntu•linux-aws-5.3

    all

  • ubuntu•linux-aws-5.4

    < 5.4.0-1045.47~18.04.1

  • ubuntu•linux-aws-fips

    < 4.15.0-2042.44 | all | < 5.4.0-1069.73+fips2

  • ubuntu•linux-aws-hwe

    < 4.15.0-1099.106~16.04.1

  • ubuntu•linux-azure

    < 4.15.0-1113.126~14.04.1 | < 4.15.0-1113.126~16.04.1 | all | < 5.4.0-1046.48

  • ubuntu•linux-azure-4.15

    < 4.15.0-1113.126

  • ubuntu•linux-azure-5.3

    all

  • ubuntu•linux-azure-5.4

    < 5.4.0-1046.48~18.04.1

  • ubuntu•linux-azure-edge

    all

  • ubuntu•linux-azure-fips

    < 4.15.0-2025.28 | all | < 5.4.0-1073.76+fips1

  • ubuntu•linux-bluefield

    all

  • ubuntu•linux-dell300x

    < 4.15.0-1017.21

  • ubuntu•linux-fips

    < 4.4.0-1061.67 | all | < 4.15.0-1058.66

  • ubuntu•linux-gcp

    < 4.15.0-1098.111~16.04.1 | all | < 5.4.0-1042.45

  • ubuntu•linux-gcp-4.15

    < 4.15.0-1098.111

  • ubuntu•linux-gcp-5.3

    all

  • ubuntu•linux-gcp-5.4

    < 5.4.0-1042.45~18.04.1

  • ubuntu•linux-gcp-edge

    all

  • ubuntu•linux-gcp-fips

    all | < 5.4.0-1067.71~20.04.1

  • ubuntu•linux-gke

    < 5.4.0-1042.44

  • ubuntu•linux-gke-4.15

    all

  • ubuntu•linux-gke-5.3

    < 5.3.0-1042.45

  • ubuntu•linux-gke-5.4

    < 5.4.0-1042.44~18.04.1

  • ubuntu•linux-gkeop

    < 5.4.0-1014.15

  • ubuntu•linux-gkeop-5.4

    < 5.4.0-1014.15~18.04.1

  • ubuntu•linux-hwe

    < 4.15.0-142.146~16.04.1 | < 5.3.0-73.69

  • ubuntu•linux-hwe-5.4

    < 5.4.0-72.80~18.04.1

  • ubuntu•linux-hwe-5.8

    < 5.8.0-50.56~20.04.1

  • ubuntu•linux-hwe-edge

    all | all

  • ubuntu•linux-intel-iot-realtime

    all

  • ubuntu•linux-kvm

    < 4.4.0-1092.101 | < 4.15.0-1090.92 | < 5.4.0-1038.39

  • ubuntu•linux-lts-xenial

    < 4.4.0-209.241~14.04.1

  • ubuntu•linux-oem

    all

  • ubuntu•linux-oem-5.10

    < 5.10.0-1022.23

  • ubuntu•linux-oem-5.6

    < 5.6.0-1054.58

  • ubuntu•linux-oracle

    < 4.15.0-1070.78~16.04.1 | < 4.15.0-1070.78 | < 5.4.0-1043.46

  • ubuntu•linux-oracle-5.0

    all

  • ubuntu•linux-oracle-5.3

    all

  • ubuntu•linux-oracle-5.4

    < 5.4.0-1043.46~18.04.1

  • ubuntu•linux-raspi

    < 5.4.0-1034.37

  • ubuntu•linux-raspi-5.4

    < 5.4.0-1034.37~18.04.1

  • ubuntu•linux-raspi-realtime

    all

  • ubuntu•linux-raspi2

    < 4.4.0-1151.162 | < 4.15.0-1084.89 | all

  • ubuntu•linux-raspi2-5.3

    < 5.3.0-1039.41

  • ubuntu•linux-realtime

    all

Showing first 50 affected entries in server-rendered view.

References (13)