Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

CVE-2023-0386 is a vulnerability identified in the Linux kernel version 6.2-rc6, specifically within the OverlayFS filesystem subsystem. OverlayFS allows the overlaying of one filesystem on top of another, commonly used in container environments and various Linux distributions. The vulnerability stems from a flaw in how the kernel handles setuid files with capabilities when they are copied from a mount point with the 'nosuid' option to another mount point. The 'nosuid' mount option is intended to prevent the execution of setuid binaries, which can escalate privileges. However, due to improper UID mapping and capability handling in OverlayFS, a local user can bypass these restrictions and execute a setuid file with elevated capabilities. This results in unauthorized privilege escalation, allowing the attacker to gain higher system privileges than intended. The vulnerability is classified under CWE-282, which relates to improper control of an object's lifetime or improper authorization. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local (AV:L), low attack complexity (AC:L), requiring low privileges (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Although no exploits have been reported in the wild, the nature of the flaw makes it a significant risk for systems running the affected kernel versions, especially those exposed to multiple local users or untrusted accounts. The vulnerability is particularly relevant for environments using containerization or overlay filesystems extensively, such as cloud services and enterprise Linux deployments.

Detailed information about CVE-2023-0386: CWE-282 in Kernel affecting null Kernel. Get real-time updates, technical details, and mitigation strategies.

CVE-2023-0386: CWE-282 in Kernel - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2023-0386: CWE-282 in Kernel

Threats Tagged 'cve-2023-0386'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2023-0386'

Lead Pen Test Professional