CVE-2021-26910

概要

参考情報

• openwall.com/lists/oss-security/2021/02/09/1 · Exploit
• netblue30/firejail commit 97d8a03 · Patch
• netblue30/firejail release 0.9.64.4 · Release Notes
• lists.debian.org/debian-lts-announce/2021/02/msg00015.html · Third Party Advisory
• security.gentoo.org/glsa/202105-19 · Third Party Advisory
• unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root · Exploit
• unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt · Exploit
• debian.org/security/2021/dsa-4849 · Third Party Advisory

firejail のその他の脆弱性

• CVE-2022-31214高 7.8A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by …
• CVE-2020-17368緊急 9.8Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command inje…
• CVE-2020-17367高 7.8Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection.
• CVE-2019-12589高 8.8In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process th…
• CVE-2019-12499高 8.1Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail…