How To Add Exploit (CVE-2023-0386 OverlayFS) about linux-exploit-suggester HOT 1 OPEN

I haven't had the time to look properly where the variables are used (and I could be out of my depth), but could it have something to do with the way the variables are assigned. There are both a short and full version of the variables in the parseUname function.

1866: KERNEL=$(echo "$uname" | awk '{print $3}' | cut -d '-' -f 1)
1867: KERNEL_ALL=$(echo "$uname" | awk '{print $3}')

If its using $KERNEL, the regex would bypass the minor versions and provide false positives.

Linux ubuntu 5.15.0-70-generic #80~20.04.1-Ubuntu SMP Wed May 17 14:58:14 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Linux ubuntu 5.15.0-73-generic #80~20.04.1-Ubuntu SMP Wed May 17 14:58:14 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

$KERNEL for the uname's above would both be 5.15.0
If $KERNEL_ALL is used then i agree that the regex would only match 5.15.0- from 5.15.0-73-generic

It may well be barking up the wrong tree but it could be worth looking into if your up to date VM still comes back as highly probably. Hopefully its a helpful suggestion, if not - apologies! (:

P.S. Big fan

from linux-exploit-suggester.