CVE-2023-2640

HIGH EXPLOITED NUCLEI

GameOver(lay) Privilege Escalation and Container Escape

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2023-2640 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 15 public exploits from researchers including g1vi, luanoliveira350, OllaPapito, including a Metasploit module exploits/linux/local/gameoverlay_privesc. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains a functional exploit script for CVE-2023-2640 and CVE-2023-32629, which are privilege escalation vulnerabilities in Ubuntu kernels due to improper permission checks in overlayfs. The exploit leverages overlayfs to set privileged extended attributes and gain root access.

Description

On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.

Exploits (15)

nomisec WORKING POC 132 stars
by g1vi · poc
https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629

The repository contains a functional exploit script for CVE-2023-2640 and CVE-2023-32629, which are privilege escalation vulnerabilities in Ubuntu kernels due to improper permission checks in overlayfs. The exploit leverages overlayfs to set privileged extended attributes and gain root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu kernels 5.4.0, 5.19.0, 6.2.0
No auth needed
Prerequisites: Unprivileged user access on a vulnerable Ubuntu kernel
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 17 stars
by luanoliveira350 · local
https://github.com/luanoliveira350/GameOverlayFS

The repository contains a functional exploit script for CVE-2023-2640 and CVE-2023-32629, targeting a vulnerability in OverlayFS on Ubuntu 20.04 with kernel 5.4.0. The script leverages unshare, setcap, and overlay mounting to escalate privileges and execute commands as root.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu 20.04 with kernel 5.4.0 (OverlayFS)
No auth needed
Prerequisites: Access to a non-root user account · Ubuntu 20.04 with kernel 5.4.0
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 13 stars
by OllaPapito · local
https://github.com/OllaPapito/gameoverlay

This repository contains a functional local privilege escalation (LPE) exploit for CVE-2023-2640, targeting Ubuntu systems with specific kernel versions. The exploit leverages overlayfs and capability manipulation to escalate privileges to root.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu (23.04, 22.10, 22.04, 20.04, 18.04 with specific kernel versions)
Auth required
Prerequisites: Local access to the target system · Specific kernel versions vulnerable to CVE-2023-2640
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by musorblyat · local
https://github.com/musorblyat/CVE-2023-2640-CVE-2023-32629

The repository contains a functional privilege escalation exploit for CVE-2023-2640 and CVE-2023-32629, leveraging overlayfs and capability manipulation to gain root access. The script automates the exploitation process by creating directories, copying Python, setting capabilities, and mounting an overlay filesystem.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (specific versions affected by CVE-2023-2640 and CVE-2023-32629)
No auth needed
Prerequisites: User access to a vulnerable Linux system · Presence of overlayfs support · Python3 binary available
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by K5LK · local
https://github.com/K5LK/CVE-2023-2640-32629

The repository contains a functional privilege escalation exploit for CVE-2023-2640 and CVE-2023-32629, leveraging overlayfs and setcap to gain root access on vulnerable Ubuntu kernels. The PoC script automates the exploitation process by creating a namespace, mounting an overlay filesystem, and executing a Python payload to escalate privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu kernels 6.2.0, 5.19.0, and 5.4.0
No auth needed
Prerequisites: unprivileged user access · vulnerable Ubuntu kernel version · overlayfs support · setcap binary available
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by Nkipohcs · local
https://github.com/Nkipohcs/CVE-2023-2640-CVE-2023-32629

The repository contains functional exploit scripts for CVE-2023-2640 and CVE-2023-32629, leveraging overlayfs and capability manipulation to achieve local privilege escalation on Ubuntu systems. The scripts use unshare, setcap, and overlayfs mounting to gain root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu (specific versions affected by CVE-2023-2640 and CVE-2023-32629)
No auth needed
Prerequisites: Local access to the target system · Presence of vulnerable kernel and overlayfs configuration
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by SanjayRagavendar · local
https://github.com/SanjayRagavendar/Ubuntu-GameOver-Lay

The repository contains a functional exploit script (`exp.sh`) that leverages CVE-2023-2640 and CVE-2023-32629 to achieve local privilege escalation (LPE) on vulnerable Ubuntu kernels (6.2.0, 5.19.0, 5.4.0) by abusing overlayfs permission checks to set privileged extended attributes and escalate to root.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu Kernel (overlayfs) versions 6.2.0, 5.19.0, 5.4.0
No auth needed
Prerequisites: Unprivileged user access on a vulnerable Ubuntu system · Overlayfs module loaded · Specific kernel versions (6.2.0, 5.19.0, 5.4.0)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by amar-imamovic · local
https://github.com/amar-imamovic/CVE-2023-2640-CVE-2023-32629-Interactive-PoC

This repository contains a functional exploit for CVE-2023-2640 and CVE-2023-32629, which are Ubuntu Kernel OverlayFS vulnerabilities allowing local privilege escalation. The exploit leverages the `ovl_copy_up` flaw to leak high-privilege capabilities and execute a true root shell outside the user namespace sandbox.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu Linux Kernel (versions below 6.2.0-26-generic)
No auth needed
Prerequisites: Ubuntu 22.04 LTS or similar with vulnerable kernel · unshare and overlayfs support · python3 installed
devstral-2 · analyzed Jun 11, 2026 Full analysis →
nomisec WORKING POC
by z3usx01 · poc
https://github.com/z3usx01/CVE-2023-2640-3262-PoC

This repository contains functional exploit scripts for CVE-2023-2640 and CVE-2023-3262, which are OverlayFS local privilege escalation vulnerabilities in Ubuntu. The scripts demonstrate the exploitation of permission handling and capability escalation issues to achieve root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu with vulnerable OverlayFS implementation
No auth needed
Prerequisites: local access · unshare · setcap · mount
devstral-2 · analyzed Apr 10, 2026 Full analysis →
github WORKING POC
by z3usx01 · shellpoc
https://github.com/z3usx01/CVE-2023-2640-3262-PoC/tree/main/CVE-2023-2640.sh

This PoC demonstrates CVE-2023-2640, an OverlayFS permission issue, by creating a directory structure and mounting an overlay filesystem to exploit incorrect permission handling. The script uses unshare and mount commands to trigger the vulnerability.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: Linux Kernel (OverlayFS)
No auth needed
Prerequisites: Linux system with OverlayFS support · unshare and mount privileges
devstral-2 · analyzed Apr 10, 2026 Full analysis →
nomisec WORKING POC
by filippo-zullo98 · poc
https://github.com/filippo-zullo98/phpMyAdmin-RCE-Exploit-Lab

This repository contains a functional exploit for CVE-2018-12613 (phpMyAdmin RCE) and CVE-2023-2640 (GameOver(lay) privilege escalation). It includes Python-based RCE exploit, reverse shell scripts, and kernel exploit for privilege escalation.

Classification
Working Poc 95%
Attack Type
Rce, Lpe
Complexity
Moderate
Reliability
Reliable
Target: phpMyAdmin 4.8.0/4.8.1, Linux Kernel 5.19.0/6.2.0/5.4.0
Auth required
Prerequisites: phpMyAdmin with vulnerable version · PHP < 7.3 without restrictive disable_functions · Vulnerable Linux kernel for privilege escalation
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC
by g1vi, h00die, bwatters-r7, gardnerapp · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/gameoverlay_privesc.rb

This Metasploit module exploits CVE-2023-2640, a privilege escalation vulnerability in Ubuntu kernels due to unsafe overlayfs operations. It leverages the vulnerability to gain root access by manipulating file capabilities in a union-mounted directory.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu Linux kernels (specific versions listed in the code)
No auth needed
Prerequisites: Access to a vulnerable Ubuntu system with overlayfs support · Ability to execute commands on the target system
devstral-2 · analyzed Apr 23, 2026 Full analysis →
vulncheck_xdb SUSPICIOUS
local
https://github.com/xS9NTX/CVE-2023-32629-CVE-2023-2640-Ubuntu-Privilege-Escalation-POC

The repository contains only a README with minimal information, no exploit code, and references two CVEs without technical details. It appears to be a placeholder or lure.

Classification
Suspicious 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: Ubuntu (unspecified version)
No auth needed
Prerequisites: none specified
devstral-2 · analyzed Feb 25, 2026 Full analysis →
vulncheck_xdb WORKING POC
local
https://github.com/k4but0/Ubuntu-LPE

This script exploits a local privilege escalation vulnerability by leveraging overlayfs and capability manipulation to gain root access. It uses unshare, setcap, and overlayfs mounting to bypass restrictions and execute a shell with elevated privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu (specific version not specified)
No auth needed
Prerequisites: unshare command availability · overlayfs support · python3 with setcap capability
devstral-2 · analyzed Feb 25, 2026 Full analysis →
vulncheck_xdb WORKING POC
local
https://github.com/ThrynSec/CVE-2023-32629-CVE-2023-2640---POC-Escalation

The repository contains a functional privilege escalation exploit for CVE-2023-32629 and CVE-2023-2640, leveraging overlayfs and capability manipulation to gain root access on vulnerable Ubuntu systems. The exploit is a bash one-liner that automates the process.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu (specific versions affected by CVE-2023-32629 and CVE-2023-2640)
No auth needed
Prerequisites: unshare command availability · overlayfs support · python3 with setuid capabilities
devstral-2 · analyzed Feb 25, 2026 Full analysis →

Nuclei Templates (1)

GameOver(lay) - Local Privilege Escalation in Ubuntu Kernel
HIGHVERIFIEDby princechaddha
Shodan: cpe:"cpe:2.3:o:canonical:ubuntu_linux"

References (4)

Core 4
Core References
Vendor Advisory vendor-advisory
https://ubuntu.com/security/notices/USN-6250-1
Exploit, Mitigation, Third Party Advisory technical-description
https://wiz.io/blog/ubuntu-overlayfs-vulnerability

Scores

CVSS v3 7.8
EPSS 0.1578
EPSS Percentile 96.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

VulnCheck KEV 2024-08-21
CWE
CWE-863
Status published
Products (1)
canonical/ubuntu_linux 23.04
Published Jul 26, 2023
Tracked Since Feb 18, 2026