Vulnerability CVE-2017-5226: Information

Description

When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.

Severity: CRITICAL (10.0) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5226
Published: March 29, 2017
Modified: March 17, 2023
Error type identifier: CWE-20

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
bubblewrapsisyphus0.1.6-alt10.8.0-alt1ALT-PU-2017-1099-1177291Fixed
bubblewrapp100.1.6-alt10.8.0-alt1ALT-PU-2017-1099-1177291Fixed
bubblewrapp90.1.6-alt10.4.1-alt2ALT-PU-2017-1099-1177291Fixed
bubblewrapc10f10.1.6-alt10.8.0-alt1ALT-PU-2017-1099-1177291Fixed
bubblewrapc9f20.1.6-alt10.5.0-alt2ALT-PU-2017-1099-1177291Fixed
tcshsisyphus6.20.00-alt26.20.00-alt4ALT-PU-2017-2110-1187457Fixed
tcshp106.20.00-alt26.20.00-alt4ALT-PU-2017-2110-1187457Fixed
tcshp96.20.00-alt26.20.00-alt2ALT-PU-2017-2110-1187457Fixed
tcshc10f16.20.00-alt26.20.00-alt4ALT-PU-2017-2110-1187457Fixed
tcshc9f26.20.00-alt26.20.00-alt2ALT-PU-2017-2110-1187457Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://github.com/projectatomic/bubblewrap/issues/142
  • Exploit
  • Patch
  • Vendor Advisory
https://github.com/projectatomic/bubblewrap/commit/d7fc532c42f0e9bf427923bab85433282b3e5117
  • Patch
https://bugzilla.redhat.com/show_bug.cgi?id=1411811
  • Issue Tracking
  • Patch
97260
  • Third Party Advisory
  • VDB Entry
[oss-security] 20200710 WebKitGTK and WPE WebKit Security Advisory WSA-2020-0006
    https://www.openwall.com/lists/oss-security/2023/03/14/2
      [oss-security] 20230317 flatpak: CVE-2023-28100: TIOCLINUX can send commands outside sandbox if running on a virtual console

          1. Configuration 1

            cpe:2.3:a:projectatomic:bubblewrap:*:*:*:*:*:*:*:*
            End including
            0.1.5
        VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
        Version: v24.5.1
        Back to top