Description
When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bubblewrap | 0.1.5-2 | — |
| Debian 13 | bubblewrap | 0.1.5-2 | — |
| Debian 12 | bubblewrap | 0.1.5-2 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bubblewrap | 0.5.0-1.1 | openSUSE-SU-2024:10663-1 |
| openSUSE Tumbleweed | flatpak | 1.11.3-1.2 | openSUSE-SU-2024:10762-1 |
Advisories 2
- openSUSE-SU-2024:10663-1 bubblewrap-0.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10762-1 flatpak-1.11.3-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/projectatomic/bubblewrap/issues/142
- 97260 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1411811
- https://github.com/projectatomic/bubblewrap/commit/d7fc532c42f0e9bf427923bab85433282b3e5117
- [oss-security] 20200710 WebKitGTK and WPE WebKit Security Advisory WSA-2020-0006 mailing-list
- https://www.openwall.com/lists/oss-security/2023/03/14/2
- [oss-security] 20230317 flatpak: CVE-2023-28100: TIOCLINUX can send commands outside sandbox if running on a virtual console mailing-list