Firejail does not restrict access to --tmpfs, which allows local users to gain privileges, as demonstrated by mounting over /etc.

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

References

• [oss-security] 20170105 Re: Firejail local root exploit mailing-list
• [oss-security] 20170106 Re: Firejail local root exploit mailing-list