CME-604

Unprivileged User Namespaces Disabled

Harden OS/Kernel Unquantified evidence Preventive

Description

Prevents unprivileged users from creating user namespaces. User namespaces expose kernel attack surface (mount, network, PID operations) to unprivileged users and have been a frequent LPE vector.

CVSS Vector Impacts

Metric	Transition	Rationale
Privileges Required (PR)	L → H	Unprivileged user cannot create namespaces to reach privileged kernel paths
Attack Complexity (AC)	L → H	Many kernel LPE exploits require user namespaces as a prerequisite

CWE Relationships

CWE-269 CWE-119

Verification

Check user.max_user_namespaces sysctl

$ cat /proc/sys/user/max_user_namespaces
# Expected: 0

Platform: linux

$ sysctl kernel.unprivileged_userns_clone 2>/dev/null
# Expected: kernel.unprivileged_userns_clone = 0

Platform: debian

Remediation

linux Disable unprivileged user namespaces via user.max_user_namespaces sysctl


sysctl -w user.max_user_namespaces=0
printf 'user.max_user_namespaces = 0\n' > /etc/sysctl.d/99-cme-604-userns.conf

debian Disable unprivileged user namespaces via kernel.unprivileged_userns_clone sysctl


sysctl -w kernel.unprivileged_userns_clone=0
printf 'kernel.unprivileged_userns_clone = 0\n' > /etc/sysctl.d/99-cme-604-userns.conf