CVE-2022-31214

Katalog CVE

CVSS 7.8 · High EPSS 0,39%

Kerentanan Improper Privilege Management pada firejail project firejail, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.

Rincian

Terbit di NVD

9 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.openwall.com/lists/oss-security/2022/06/08/10 mailing list · patch · advisory pihak ketiga
• https://firejail.wordpress.com/download-2/release-notes/ release notes · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/06/msg00023.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5167 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RZOTZ36RUSL6...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUZZ5M6LIBYRK...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIBEBE3KFINMG...
• https://security.gentoo.org/glsa/202305-19