Fuse Overlayfs
Monthly
Incorrect SUID/SGID bit preservation in fuse-overlayfs before version 1.17 allows a low-privileged process inside a rootless container to leave an upper-layer file with mode 4777 (setuid plus world-writable) by triggering a copy-up via open(O_TRUNC) or truncate. The vulnerability is confined to local container contexts and carries a CVSS 4.0 score of 2.0, reflecting narrow exploitation conditions and limited integrity-only impact. No active exploitation (KEV) or public exploit code has been identified at time of analysis.
Incorrect SUID/SGID bit preservation in fuse-overlayfs before version 1.17 allows a low-privileged process inside a rootless container to leave an upper-layer file with mode 4777 (setuid plus world-writable) by triggering a copy-up via open(O_TRUNC) or truncate. The vulnerability is confined to local container contexts and carries a CVSS 4.0 score of 2.0, reflecting narrow exploitation conditions and limited integrity-only impact. No active exploitation (KEV) or public exploit code has been identified at time of analysis.