CVE-2017-5226: Input Validation
When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
References:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850702
Upstream bugs:
https://github.com/projectatomic/bubblewrap/issues/142 https://github.com/projectatomic/bubblewrap/pull/143
Upstream patch:
https://github.com/projectatomic/bubblewrap/commit/d7fc532c42f0e9bf427923bab85433282b3e5117
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/bubblewrapto a version that resolves this vulnerability.Fixed in 0.1.5 - Upgrade
Upgrade
debian/bubblewrapto a version that resolves this vulnerability.Fixed in 0.4.1-3Fixed in 0.8.0-2Fixed in 0.9.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5226?
CVE-2017-5226 is considered a high-severity vulnerability due to the risk of sandbox escape.
How does CVE-2017-5226 allow an attacker to escape the sandbox?
CVE-2017-5226 allows an attacker to escape the sandbox by using the TIOCSTI ioctl to push characters into the terminal's input buffer.
Which versions of bubblewrap are affected by CVE-2017-5226?
CVE-2017-5226 affects bubblewrap versions up to and including 0.1.5.
How do I fix CVE-2017-5226?
To fix CVE-2017-5226, upgrade bubblewrap to version 0.4.1-3 or later.
What types of systems are impacted by CVE-2017-5226?
CVE-2017-5226 impacts systems using bubblewrap versions prior to 0.4.1-3, particularly on Debian-based and Red Hat-based distributions.