Coverage › CVE-2023-0386

CVE-2023-0386 Stale Sigma

Linux Kernel Improper Ownership Management Vulnerability

Vendor / product

Linux — Kernel

Description (CISA)

Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

Added to KEV

2025-06-17

Due date

2025-07-08

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-282

CISA notes

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a
https://access.redhat.com/security/cve/cve-2023-0386
https://security.netapp.com/advisory/ntap-20230420-0004/
https://nvd.nist.gov/vuln/detail/CVE-2023-0386

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1055.012 Process Hollowing exploitation technique

• DET0382 Detection Strategy for Process Hollowing on Windows
  AN1076 Windows

  Detects adversary use of suspended process creation, using the CREATE_SUSPENDED flag via CreateProcess, followed by unmapping the memory of the child process (NtUnmapViewOfSection) and replacing it with malicious code via VirtualAllocEx/WriteProcessMemory, then SetThreadContext and ResumeThread to begin execution within the hollowed process.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Sysmon EventCode=8 → DC0020 Process Modification

  etw:Microsoft-Windows-Kernel-Process NtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread → DC0021 OS API Execution

  Tunable: HollowedImageNamePattern TimeWindow_ProcessCreateToResume SuspendedProcessStartFlag MemoryWriteSizeThreshold

Sigma rules tagged attack.t1055.012 (5)

T1543 Create or Modify System Process primary impact

• DET0571 Detection of System Process Creation or Modification Across Platforms
  AN1575 Windows

  Detects command-line or API-based creation/modification of Windows Services via sc.exe, powershell.exe, services.exe, or ChangeServiceConfig. Looks for creation/modification of autostart services via registry changes, file drops to System32\services, and anomalous parent-child process trees.

  WinEventLog:Security EventCode=4697 → DC0060 Service Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

  Tunable: ServiceNamePattern ParentProcessFilter RegistryPathList
  AN1576 Linux

  Detects creation or modification of systemd service units, addition of cron jobs that invoke binaries on boot, or suspicious writes to /etc/init.d/. Monitors chmod +x and systemctl execution paths, especially from non-root parent processes.

  auditd:SYSCALL write or rename to /etc/systemd/system or /etc/init.d → DC0061 File Modification

  auditd:SYSCALL execution of systemctl or service with enable/start/modify → DC0064 Command Execution

  Tunable: ServicePathRegex UserContextList CommandNameList
  AN1577 macOS

  Detects creation or modification of LaunchDaemon or LaunchAgent plist files under /Library/LaunchDaemons/, ~/Library/LaunchAgents/, or similar. Monitors execution of launchctl, property list edits, and file permission changes.

  macos:unifiedlog launchctl load/unload or plist file modification → DC0064 Command Execution

  fs:fsusage file write to launchd plist paths → DC0061 File Modification

  Tunable: PlistPathList PlistKeyMonitor UnsignedBinaryAlert
  AN1578 Containers

  Detects creation of new container system processes via docker run --restart, kubectl exec to init containers, or modification of container init specs. Flags container images that override entrypoints to embed persistence behaviors.

  docker:events docker run with restart=always or modifying init → DC0072 Container Creation

  auditd:SYSCALL modification of entrypoint scripts or init containers → DC0061 File Modification

  Tunable: EntrypointOverridePattern RestartPolicyMatch KubeInitModPath

Sigma rules tagged attack.t1543 (9)

T1548.001 Setuid and Setgid exploitation technique

• DET0110 Setuid/Setgid Privilege Abuse Detection (Linux/macOS)
  AN0307 Linux

  Correlation of chmod operations setting setuid/setgid bits followed by privileged process execution (EUID != UID), especially from user-writable or abnormal paths.

  auditd:SYSCALL chmod, execve → DC0064 Command Execution

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: UserContext FilePathScope TimeWindow
  AN0308 macOS

  Observation of chmod commands setting setuid/setgid bits, paired with launch of binaries under elevated execution context (e.g., root-owned binaries launched by unprivileged users).

  macos:unifiedlog chmod command with arguments including '+s', 'u+s', or numeric values 4000–6777 → DC0064 Command Execution

  macos:unifiedlog exec of binary with setuid/setgid and EUID != UID → DC0034 Process Metadata

  Tunable: UserContext ExecutionPath ChmodPattern

Sigma rules tagged attack.t1548.001 (2)