CVE-2017-5226 When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an at...
CriticalCVSS 10.0
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/bubblewrap(Debian:12) | < 0.1.5-2 | 0.1.5-2 |
| debian/bubblewrap(Debian:13) | < 0.1.5-2 | 0.1.5-2 |
| debian/bubblewrap(Debian:14) | < 0.1.5-2 | 0.1.5-2 |
| projectatomic bubblewrap | <= 0.1.5 | No fix listed |
References
- Debian Security Tracker CVE-2017-5226 vendor-advisory
- [oss-security] 20200710 WebKitGTK and WPE WebKit Security Advisory WSA-2020-0006 mailing-list
- [oss-security] 20230317 flatpak: CVE-2023-28100: TIOCLINUX can send commands outside sandbox if running on a virtual console mailing-list
- 97260 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking patch
- github.com patch
- github.com exploit patch vendor-advisory
- www.openwall.com
- bugs.debian.org issue-tracking