UBUNTU-CVE-2021-3493

Advisory lineage Upstream: 1 Downstream: 4
Upstream
CVE-2021-3493
Published: 15 Apr 2021, 17:00
Last modified:03 Jun 2026, 13:34

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.8 HIGH
3.1 (osv_ubuntu)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Apr 2021, 17:00
Published
Vulnerability first disclosed
03 Jun 2026, 13:34
Last Modified
Vulnerability information updated

Description

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

CVSS Metrics

  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Systems

  • ubuntu•linux

    < 4.4.0-209.241 | < 4.15.0-142.146 | < 5.4.0-72.80

  • ubuntu•linux-aws

    < 4.4.0-1091.95 | < 4.4.0-1127.141 | < 4.15.0-1099.106 | < 5.4.0-1045.47

  • ubuntu•linux-aws-5.0

    all

  • ubuntu•linux-aws-5.3

    all

  • ubuntu•linux-aws-5.4

    < 5.4.0-1045.47~18.04.1

  • ubuntu•linux-aws-fips

    < 4.15.0-2042.44 | all | < 5.4.0-1069.73+fips2

  • ubuntu•linux-aws-hwe

    < 4.15.0-1099.106~16.04.1

  • ubuntu•linux-azure

    < 4.15.0-1113.126~14.04.1 | < 4.15.0-1113.126~16.04.1 | all | < 5.4.0-1046.48

  • ubuntu•linux-azure-4.15

    < 4.15.0-1113.126

  • ubuntu•linux-azure-5.3

    all

  • ubuntu•linux-azure-5.4

    < 5.4.0-1046.48~18.04.1

  • ubuntu•linux-azure-edge

    all

  • ubuntu•linux-azure-fips

    < 4.15.0-2025.28 | all | < 5.4.0-1073.76+fips1

  • ubuntu•linux-bluefield

    all

  • ubuntu•linux-dell300x

    < 4.15.0-1017.21

  • ubuntu•linux-fips

    < 4.4.0-1061.67 | all | < 4.15.0-1058.66

  • ubuntu•linux-gcp

    < 4.15.0-1098.111~16.04.1 | all | < 5.4.0-1042.45

  • ubuntu•linux-gcp-4.15

    < 4.15.0-1098.111

  • ubuntu•linux-gcp-5.3

    all

  • ubuntu•linux-gcp-5.4

    < 5.4.0-1042.45~18.04.1

  • ubuntu•linux-gcp-edge

    all

  • ubuntu•linux-gcp-fips

    all | < 5.4.0-1067.71~20.04.1

  • ubuntu•linux-gke

    < 5.4.0-1042.44

  • ubuntu•linux-gke-4.15

    all

  • ubuntu•linux-gke-5.3

    < 5.3.0-1042.45

  • ubuntu•linux-gke-5.4

    < 5.4.0-1042.44~18.04.1

  • ubuntu•linux-gkeop

    < 5.4.0-1014.15

  • ubuntu•linux-gkeop-5.4

    < 5.4.0-1014.15~18.04.1

  • ubuntu•linux-hwe

    < 4.15.0-142.146~16.04.1 | < 5.3.0-73.69

  • ubuntu•linux-hwe-5.4

    < 5.4.0-72.80~18.04.1

  • ubuntu•linux-hwe-5.8

    < 5.8.0-50.56~20.04.1

  • ubuntu•linux-hwe-edge

    all | all

  • ubuntu•linux-intel-iot-realtime

    all

  • ubuntu•linux-kvm

    < 4.4.0-1092.101 | < 4.15.0-1090.92 | < 5.4.0-1038.39

  • ubuntu•linux-lts-xenial

    < 4.4.0-209.241~14.04.1

  • ubuntu•linux-nvidia

    all

  • ubuntu•linux-oem

    all

  • ubuntu•linux-oem-5.10

    < 5.10.0-1022.23

  • ubuntu•linux-oem-5.6

    < 5.6.0-1054.58

  • ubuntu•linux-oracle

    < 4.15.0-1070.78~16.04.1 | < 4.15.0-1070.78 | < 5.4.0-1043.46

  • ubuntu•linux-oracle-5.0

    all

  • ubuntu•linux-oracle-5.3

    all

  • ubuntu•linux-oracle-5.4

    < 5.4.0-1043.46~18.04.1

  • ubuntu•linux-raspi

    < 5.4.0-1034.37

  • ubuntu•linux-raspi-5.4

    < 5.4.0-1034.37~18.04.1

  • ubuntu•linux-raspi-realtime

    all

  • ubuntu•linux-raspi2

    < 4.4.0-1151.162 | < 4.15.0-1084.89 | all

  • ubuntu•linux-raspi2-5.3

    < 5.3.0-1039.41

  • ubuntu•linux-realtime

    all

  • ubuntu•linux-riscv

    all

Showing first 50 affected entries in server-rendered view.

References (7)