CVE-2021-3847

EUVD-2021-27089
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 8%
Affected Products (NVD)
VendorProductVersion
linuxlinux_kernel
𝑥
≤ 5.17.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
sid
vulnerable
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
bionic
ignored
focal
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
ignored
xenial
ignored
linux-aws
bionic
ignored
focal
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
ignored
xenial
ignored
linux-aws-5.0
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-5.11
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-5.13
bionic
dne
focal
ignored
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-5.3
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-5.4
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-5.8
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-hwe
bionic
dne
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
ignored
linux-azure
bionic
ignored
focal
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
ignored
xenial
ignored
linux-azure-4.15
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-5.11
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-5.13
bionic
dne
focal
ignored
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-5.3
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-5.4
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-5.8
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-edge
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-fde
bionic
dne
focal
ignored
impish
dne
jammy
ignored
kinetic
dne
trusty
dne
xenial
dne
linux-azure-fde-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-bluefield
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-dell300x
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp
bionic
ignored
focal
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
dne
xenial
ignored
linux-gcp-4.15
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp-5.11
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp-5.13
bionic
dne
focal
ignored
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp-5.3
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp-5.4
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp-5.8
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gke
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
ignored
kinetic
dne
trusty
dne
xenial
ignored
linux-gke-4.15
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gke-5.0
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gke-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gke-5.3
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gke-5.4
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gkeop
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
ignored
kinetic
dne
trusty
dne
xenial
dne
linux-gkeop-5.4
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-hwe
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
ignored
linux-hwe-5.11
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-hwe-5.13
bionic
dne
focal
ignored
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-hwe-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-hwe-5.4
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-hwe-5.8
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-hwe-edge
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
ignored
linux-ibm
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
ignored
kinetic
ignored
trusty
dne
xenial
dne
linux-ibm-5.4
bionic
ignored
focal
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-intel-5.13
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-intel-iotg
bionic
dne
focal
dne
impish
dne
jammy
ignored
kinetic
dne
trusty
dne
xenial
dne
linux-intel-iotg-5.15
bionic
dne
focal
ignored
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-kvm
bionic
ignored
focal
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
dne
xenial
ignored
linux-lowlatency
bionic
dne
focal
dne
impish
dne
jammy
ignored
kinetic
ignored
trusty
dne
xenial
dne
linux-lowlatency-hwe-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-lts-xenial
bionic
dne
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
ignored
xenial
dne
linux-oem
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
ignored
linux-oem-5.10
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oem-5.13
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oem-5.14
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oem-5.17
bionic
dne
focal
dne
impish
dne
jammy
ignored
kinetic
ignored
trusty
dne
xenial
dne
linux-oem-5.6
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oem-6.0
bionic
dne
focal
dne
jammy
ignored
kinetic
dne
trusty
dne
xenial
dne
linux-oem-osp1
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle
bionic
ignored
focal
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
dne
xenial
ignored
linux-oracle-5.0
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle-5.11
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle-5.13
bionic
dne
focal
ignored
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle-5.3
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle-5.4
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle-5.8
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-raspi
bionic
dne
focal
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
dne
xenial
dne
linux-raspi-5.4
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-raspi2
bionic
ignored
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
ignored
linux-raspi2-5.3
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-riscv
bionic
dne
focal
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
dne
xenial
dne
linux-riscv-5.11
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-riscv-5.8
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-snapdragon
bionic
ignored
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
ignored
Common Weakness Enumeration
References
https://bugzilla.redhat.com/show_bug.cgi?id=2009704
https://www.openwall.com/lists/oss-security/2021/10/14/3
https://bugzilla.redhat.com/show_bug.cgi?id=2009704
https://www.openwall.com/lists/oss-security/2021/10/14/3