A flaw was found in the User namespace on an overlay filesystem in the Linux Kernel, Where a file with no access privilege was able to copy the file to a user defined mount point. An attacker with a special user privilege locally may lead to a kernel information leak problem. Upstream fix: 48bd024b8a40d73ad6b086de2615738da0c7004f ("ovl: switch to mounter creds in readdir") 56230d956739b9cb1cbde439d76227d77979a04d ("ovl: verify permissions in ovl_path_open()") 05acefb4872dae89e772729efb194af754c877e8 ("ovl: check permission to open real file")
It is my understanding that the attacker must have a number of conditions in place for this attack to work correctly. The target file must exist on an overlay filesystem. The target file must be accessible in the namespace. The destination must be writable by the exploiting target. This doesn't mean that the attacker can choose what the target is, only that the information within the original file can accessed by bypassing existing permissions..
Mitigation: Red Hat feels this flaw needs a number of conditions in place for the attacker to exploit, and the mitigation for this issue is to avoid a target file t existing on an overlay filesystem, accessible in the namespace, which is writable by the exploiting target.