CVE-2023-32629

HIGH EXPLOITED

Ubuntu Linux - Local Privilege Escalation via OverlayFS Permission Check Bypass

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-32629 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 11 public exploits from researchers including ThrynSec, kaotickj, k4but0, including a Metasploit module exploits/linux/local/gameoverlay_privesc.

AI-analyzed exploit summary This PoC exploits CVE-2023-32629 and CVE-2023-2640 to achieve local privilege escalation on Ubuntu systems by leveraging overlayfs and capability manipulation to gain root access via a Python script.

Description

Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu kernels

Exploits (11)

nomisec WORKING POC 106 stars
by ThrynSec · local
https://github.com/ThrynSec/CVE-2023-32629-CVE-2023-2640---POC-Escalation

This PoC exploits CVE-2023-32629 and CVE-2023-2640 to achieve local privilege escalation on Ubuntu systems by leveraging overlayfs and capability manipulation to gain root access via a Python script.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu (specific versions affected by CVE-2023-32629 and CVE-2023-2640)
Auth required
Prerequisites: Local access to the target system · Presence of vulnerable kernel and Python3
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 9 stars
by kaotickj · poc
https://github.com/kaotickj/Check-for-CVE-2023-32629-GameOver-lay

This repository contains a Python script that checks for the presence of CVE-2023-32629 and CVE-2023-2640 vulnerabilities in the Linux kernel's OverlayFS module. It performs checks for vulnerable kernel versions, functions, and OverlayFS usage.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Linux kernel OverlayFS module (Ubuntu)
Auth required
Prerequisites: root privileges · Python 3 · git installed (for CVE-2023-2640 check)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 4 stars
by k4but0 · local
https://github.com/k4but0/Ubuntu-LPE

This exploit leverages a local privilege escalation vulnerability in Ubuntu by manipulating overlayfs and setcap to gain root access. It uses unshare to create a new mount namespace and abuses capabilities to escalate privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu (specific versions affected by CVE-2023-32629)
No auth needed
Prerequisites: Local access to the target system · Presence of vulnerable Ubuntu kernel
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB 1 stars
by xS9NTX · local
https://github.com/xS9NTX/CVE-2023-32629-CVE-2023-2640-Ubuntu-Privilege-Escalation-POC

The repository contains only a README.md file with minimal information about CVE-2023-32629 and CVE-2023-2640, claiming Ubuntu privilege escalation but lacking any actual exploit code or technical details.

Classification
Stub 10%
Attack Type
Lpe
Complexity
Theoretical
Reliability
Theoretical
Target: Ubuntu (version unspecified)
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WORKING POC 1 stars
by Shockp · pythonpoc
https://github.com/Shockp/CVE-Exploits/tree/main/CVE-2023-32629

The repository contains functional exploit code for multiple CVEs, including CVE-2023-32629. The exploits demonstrate remote code execution (RCE) and other offensive techniques, with clear usage instructions and technical implementation details.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Various (Tomcat, Joomla, Spring Cloud Function, Cacti, sudoedit, Screen)
Auth required
Prerequisites: Target IP/URL · Credentials (for some exploits) · Listener setup for reverse shell
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WRITEUP
by h3raklez · local
https://github.com/h3raklez/CVE-2023-32629

This repository provides a detailed technical analysis of CVE-2023-32629, a local privilege escalation vulnerability in OverlayFS. It explains the exploitation process, including the misuse of user namespaces and filesystem capabilities during copy-up operations.

Classification
Writeup 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (OverlayFS implementation)
No auth needed
Prerequisites: unprivileged user namespaces enabled · access to a vulnerable Ubuntu kernel prior to May/June 2023 patches
devstral-2 · analyzed Apr 26, 2026 Full analysis →
vulncheck_xdb WORKING POC
local
https://github.com/amar-imamovic/CVE-2023-2640-CVE-2023-32629-Interactive-PoC

This repository contains a functional exploit for CVE-2023-2640 and CVE-2023-32629, which are Ubuntu Kernel OverlayFS vulnerabilities allowing local privilege escalation. The exploit leverages a multi-step process to escape user namespace restrictions and achieve true host root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu Linux Kernel (versions below 6.2.0-26-generic)
No auth needed
Prerequisites: Ubuntu 22.04 LTS or similar with vulnerable kernel · Local user access
devstral-2 · analyzed Jun 11, 2026 Full analysis →
vulncheck_xdb WORKING POC
local
https://github.com/Nkipohcs/CVE-2023-2640-CVE-2023-32629

The repository contains functional exploit scripts for CVE-2023-32629, leveraging overlayfs and capability manipulation to achieve local privilege escalation on Ubuntu systems. The scripts use unshare, setcap, and mount commands to exploit the vulnerability and spawn a root shell.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu (specific versions affected by CVE-2023-32629)
No auth needed
Prerequisites: unshare command availability · overlayfs support · python3 binary present
devstral-2 · analyzed Feb 25, 2026 Full analysis →
vulncheck_xdb WORKING POC
local
https://github.com/musorblyat/CVE-2023-2640-CVE-2023-32629

The repository contains a functional privilege escalation exploit for CVE-2023-32629, leveraging overlayfs and capability manipulation to gain root access. The script automates the exploitation process by creating directories, copying Python, setting capabilities, and mounting an overlay filesystem.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (specific version not specified)
No auth needed
Prerequisites: unshare command availability · overlayfs support in kernel · Python 3 installed
devstral-2 · analyzed Feb 25, 2026 Full analysis →
vulncheck_xdb WORKING POC
local
https://github.com/luanoliveira350/GameOverlayFS

The repository contains a functional exploit script for CVE-2023-32629, leveraging OverlayFS misconfigurations to achieve local privilege escalation (LPE) on vulnerable Ubuntu systems. The script uses `unshare`, `setcap`, and `mount` to manipulate capabilities and file system layers, ultimately executing commands as root.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu 20.04 with kernel 5.4.0 (OverlayFS)
No auth needed
Prerequisites: Ubuntu 20.04 with kernel 5.4.0 · OverlayFS support · Python3 installed
devstral-2 · analyzed Feb 25, 2026 Full analysis →
metasploit WORKING POC
by g1vi, h00die, bwatters-r7, gardnerapp · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/gameoverlay_privesc.rb

This Metasploit module exploits CVE-2023-2640 and CVE-2023-32629, which involve unsafe overlayfs handling in specific Ubuntu kernels, allowing privilege escalation and container escape by manipulating setuid capabilities via overlayfs mounts.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu Linux with vulnerable kernels (5.4.0, 5.19.0, 6.2.0)
No auth needed
Prerequisites: Access to a vulnerable Ubuntu system with overlayfs support · Ability to execute commands as a non-root user
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 7.8
EPSS 0.0889
EPSS Percentile 94.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

VulnCheck KEV 2025-09-03
CWE
CWE-863
Status published
Products (1)
canonical/ubuntu_linux 23.04
Published Jul 26, 2023
Tracked Since Feb 18, 2026