CVE-2017-5940 Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zero, which allows loca...
HighCVSS 8.8
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-5180.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firejail(Debian:12) | < 0.9.44.6-1 | 0.9.44.6-1 |
| debian/firejail(Debian:13) | < 0.9.44.6-1 | 0.9.44.6-1 |
| debian/firejail(Debian:14) | < 0.9.44.6-1 | 0.9.44.6-1 |
| firejail project firejail | >= 0.9.38, <= 0.9.38.10 | No fix listed |
| firejail project firejail | >= 0.9.40, <= 0.9.44.6 | No fix listed |
References
- Debian Security Tracker CVE-2017-5940 vendor-advisory
- www.openwall.com mailing-list patch third-party-advisory
- 96221 third-party-advisory vdb-entry
- firejail.wordpress.com release-notes vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- GLSA-201702-03 third-party-advisory vendor-advisory