CVE-2021-26910

Опубликовано: 08 фев. 2021

Источник: nvd

CVSS3: 7.8

CVSS3: 7

CVSS2: 6.9

EPSS Низкий

Описание

Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.

Ссылки

http://www.openwall.com/lists/oss-security/2021/02/09/1
Exploit
Mailing List
Patch
Third Party Advisory
https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b
Patch
Third Party Advisory
https://github.com/netblue30/firejail/releases/tag/0.9.64.4
Release Notes
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00015.html
Third Party Advisory
https://security.gentoo.org/glsa/202105-19
Third Party Advisory
https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/
Exploit
Third Party Advisory
https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt
Exploit
Third Party Advisory
https://www.debian.org/security/2021/dsa-4849
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/02/09/1
Exploit
Mailing List
Patch
Third Party Advisory
https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b
Patch
Third Party Advisory
https://github.com/netblue30/firejail/releases/tag/0.9.64.4
Release Notes
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00015.html
Third Party Advisory
https://security.gentoo.org/glsa/202105-19
Third Party Advisory
https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/
Exploit
Third Party Advisory
https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt
Exploit
Third Party Advisory
https://www.debian.org/security/2021/dsa-4849
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:firejail_project:firejail:*:*:*:*:*:*:*:*

Версия до 0.9.64.4 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 16%

0.0005

Низкий

7.8 High

CVSS3

7 High

CVSS3

6.9 Medium

CVSS2

Дефекты

CWE-367

Связанные уязвимости

CVE-2021-26910

CVSS3: 7.8

ubuntu

почти 5 лет назад

Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.

CVE-2021-26910

CVSS3: 7.8

debian

почти 5 лет назад

Firejail before 0.9.64.4 allows attackers to bypass intended access re ...

GHSA-2q4h-h5jp-942w

CVSS3: 7

github

больше 3 лет назад

Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.

BDU:2021-03745

CVSS3: 7

fstec

почти 5 лет назад

Уязвимость компонента OverlayFS SUID песочницы Firejail, связанная с недостаточной проверкой состояния совместно используемого ресурса, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании

openSUSE-SU-2021:0271-1

suse-cvrf

почти 5 лет назад

Security update for firejail

EPSS

Процентиль: 16%

0.0005

Низкий

7.8 High

CVSS3

7 High

CVSS3

6.9 Medium

CVSS2

Дефекты

CWE-367