[New Rule] Potential Privilege Escalation via OverlayFS

[Aegrah]

Summary

Identifies an attempt to exploit a local privilege escalation (CVE-2023-2640 and CVE-2023-32629) via a flaw in Ubuntu's modifications to OverlayFS. These flaws allow the creation of specialized executables, which, upon execution, grant the ability to escalate privileges to root on the affected machine.

Detection

sequence by process.parent.entity_id, host.id with maxspan=1s
[ process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and 
  process.name == "unshare" and process.args : ("-r", "-rm", "m") and process.args : "*cap_setuid*" ]
[ process  where host.os.type == "linux" and event.action == "uid_change" and event.type == "change" and 
  user.name == "root" ]

[DefSecSentinel]

LGTM

[brokensound77]

How did you test this? Specific POC?

[Aegrah]

@brokensound77 Testing was done through PoC available at https://twitter.com/liadeliyahu/status/1684841527959273472, and manually analysis by looking at their blog https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability. I know this rule is slightly too specific, and might be easy bypassable, but for now this is the only POC available so therefore I wrote logic to detect it as-is.