CVE-2023-3611

Note

Priority reason:
By using unprivileged user namespaces, this can be exploited to achieve local privilege escalation.
similar to CVE-2023-31436.
If not needed, disable the ability for unprivileged users
to create namespaces. To do this temporarily, do:
  sudo sysctl -w kernel.unprivileged_userns_clone=0
To disable across reboots, do:
  echo kernel.unprivileged_userns_clone=0 | \
  sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Parameter	Value
Base score	7.8
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Security

CVE-2023-3611

From the Ubuntu Security Team

Notes

Mitigation

Priority

Cvss 3 Severity Score

Status

Severity score breakdown

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Further reading

Author	Note
	Priority reason: By using unprivileged user namespaces, this can be exploited to achieve local privilege escalation.
rodrigo-zaiden	similar to CVE-2023-31436.

Package	Release	Status
linux Launchpad, Ubuntu, Debian	bionic	Needed
	focal	Released (5.4.0-159.176)
	kinetic	Ignored (end of life, was needs-triage)
	jammy	Released (5.15.0-82.91)
	lunar	Released (6.2.0-31.31)
	trusty	Needed
	upstream	Released (6.5~rc2)
	xenial	Released (4.4.0-244.278) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	Patches: Introduced by 462dbc9101acd38e92eda93c0726857517a24bbd Fixed by 3e337087c3b5805fe0b8a46ba622a962880b5d64
linux-hwe Launchpad, Ubuntu, Debian	trusty	Does not exist
	bionic	Needs triage
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	upstream	Released (6.5~rc2)
	xenial	Needed
linux-hwe-5.4 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	upstream	Released (6.5~rc2)
	bionic	Released (5.4.0-159.176~18.04.1) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
linux-hwe-5.8 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	focal	Ignored (superseded by linux-hwe-5.11)
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	upstream	Ignored (superseded by linux-hwe-5.11)
linux-hwe-5.11 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	focal	Ignored (superseded by linux-hwe-5.13)
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist