PT-2017-16401 · Unknown+1 · Bubblewrap+1

Hanno Böck · Publicado 2017-01-29 · Atualizado 2024-06-15 · CVE-2017-5226

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bubblewrap (affected versions not specified)

Description The issue allows a nonpriv session to escape the bubblewrap sandbox by utilizing the TIOCSTI ioctl to push characters into the terminal's input buffer. This enables an attacker to bypass the sandbox restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2017-1099

ALT-PU-2017-2110

CVE-2017-5226

OPENSUSE-SU-2024:10663-1

OPENSUSE-SU-2024:10762-1

OPENSUSE-SU-2024:12835-1

Produtos afetados

Alt Linux

Bubblewrap

Referências · 26

• 🔥 https://github.com/projectatomic/bubblewrap/issues/142 · Exploit
• https://github.com/projectatomic/bubblewrap/commit/d7fc532c42f0e9bf427923bab85433282b3e5117 · Correção
• http://securityfocus.com/bid/97260 · Nota
• http://openwall.com/lists/oss-security/2023/03/17/1 · Nota
• https://openwall.com/lists/oss-security/2023/03/14/2 · Nota
• https://errata.altlinux.org/ALT-PU-2017-2110 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-5226 · Aviso do Fabricante
• https://t.me/cibsecurity/60169 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2020-5291 · Nota
• https://suse.com/security/cve/CVE-2019-12439 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-5226 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10762-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-5736 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5226 · Aviso do Fabricante
• https://packages.altlinux.org/ru/vuln/CVE-2017-5226 · Nota