From c8e6f41894ac1d10421e323818d603dc13580031 Mon Sep 17 00:00:00 2001
From: bcoles <bcoles@gmail.com>
Date: Tue, 20 Apr 2021 22:17:46 +1000
Subject: [PATCH] Add OverlayFS cap_convert_nscap (CVE-2021-3493)

---
 linux-exploit-suggester.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/linux-exploit-suggester.sh b/linux-exploit-suggester.sh
index b35ed0e..79f918d 100755
--- a/linux-exploit-suggester.sh
+++ b/linux-exploit-suggester.sh
@@ -904,6 +904,18 @@ author: GRIMM
 EOF
 )
 
+EXPLOITS[((n++))]=$(cat <<EOF
+Name: ${txtgrn}[CVE-2021-3493]${txtrst} OverlayFS cap_convert_nscap
+Reqs: pkg=linux-kernel,ver<5.11,pkg=fuse-overlayfs
+Tags: Ubuntu=14.04|16.04|18.04|20.04|20.10
+Rank: 1
+analysis-url: https://ssd-disclosure.com/ssd-advisory-overlayfs-pe/
+src-url: https://raw.githubusercontent.com/briskets/CVE-2021-3493/main/exploit.c
+Comments: Requires fuse-overlayfs. Likely specific to Ubuntu kernels only due to a patch which allows unprivileged overlayfs mounts.
+author: SSD
+EOF
+)
+
 ############ USERSPACE EXPLOITS ###########################
 n=0