CVE-2022-31214

A Privilege Context Switching issue was discovered in join.c in Firejail
0.9.68. By crafting a bogus Firejail container that is accepted by the
Firejail setuid-root program as a join target, a local attacker can enter
an environment in which the Linux user namespace is still the initial user
namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount
namespace is under the attacker’s control. In this way, the filesystem
layout can be adjusted to gain root privileges through execution of
available setuid-root binaries such as su or sudo.

Bugs

• <https://bugzilla.suse.com/show_bug.cgi?id=1199148&gt;