6 results · Feed
-
High 8.8
Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the san…
-
High 8.7
bubblewrap vulnerable to privilege escalation in setuid mode via ptrace
bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap and control the unprivileged part of the sandbox setup phase. …
-
High 7.2
Privilege escalation in setuid mode via user namespaces in Bubblewrap
Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be…
-
High 7.4
bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular conf…
-
Unscored —
When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the …
-
Unscored —
Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which might allow local users to gain privileges by attaching to…