Lucene search

GoogleOSV:CVE-2017-5226

HistoryMar 29, 2017 - 8:59 p.m.

CVE-2017-5226

2017-03-2920:59:00

Google

osv.dev

6.6 Medium

AI Score

Confidence

Low

0.008 Low

EPSS

Percentile

81.6%

JSON

When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal’s input buffer, allowing an attacker to escape the sandbox.

CPENameOperatorVersion
bubblewrapeq0.1.4
bubblewrapeq0.1.3
bubblewrapeq0.1.2
bubblewrapeq0.1.5
bubblewrapeq0.1.0
bubblewrapeq0.1.1

Name	Operator	Version
bubblewrap	eq	0.1.4
bubblewrap	eq	0.1.3
bubblewrap	eq	0.1.2
bubblewrap	eq	0.1.5
bubblewrap	eq	0.1.0
bubblewrap	eq	0.1.1

References

www.openwall.com/lists/oss-security/2020/07/10/1

www.openwall.com/lists/oss-security/2023/03/17/1

www.securityfocus.com/bid/97260

bugzilla.redhat.com/show_bug.cgi?id=1411811

github.com/projectatomic/bubblewrap/commit/d7fc532c42f0e9bf427923bab85433282b3e5117

github.com/projectatomic/bubblewrap/issues/142

www.openwall.com/lists/oss-security/2023/03/14/2