CVE-2017-5226
published 2017-03-29CVE-2017-5226: When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into…
PriorityP348critical10CVSS 3.0
AVNACLPRNUINSCCHIHAH
EPSS
3.17%
86.4th percentile
When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | bubblewrap | < bubblewrap 0.1.5-2 (bookworm) | bubblewrap 0.1.5-2 (bookworm) |
| debian | debian_linux | — | — |
| debian | flatpak | < flatpak 1.2.3-2 (bookworm) | flatpak 1.2.3-2 (bookworm) |
| debian | flatpak | < flatpak 1.14.4-1 (bookworm) | flatpak 1.14.4-1 (bookworm) |
| debian | webkit2gtk | < webkit2gtk 2.28.3-1 (bookworm) | webkit2gtk 2.28.3-1 (bookworm) |
| debian | wpewebkit | < webkit2gtk 2.28.3-1 (bookworm) | webkit2gtk 2.28.3-1 (bookworm) |
| fedoraproject | fedora | — | — |
| flatpak | flatpak | < 1.10.8 | 1.10.8 |
| flatpak | flatpak | < 1.10.8 | 1.10.8 |
| flatpak | flatpak | < 1.0.8 | 1.0.8 |
| flatpak | flatpak | — | — |
| flatpak | flatpak | — | — |
| flatpak | flatpak | — | — |
| flatpak | flatpak | — | — |
| flatpak | flatpak | >= 0 < 1.10.8-0+deb11u1 | 1.10.8-0+deb11u1 |
| flatpak | flatpak | >= 0 < 1.2.3-2 | 1.2.3-2 |
| flatpak | flatpak | >= 0 < 1.14.4-1 | 1.14.4-1 |
| flatpak | flatpak | >= 0 < 1.2.3-2 | 1.2.3-2 |
| flatpak | flatpak | >= 0 < 1.14.4-1 | 1.14.4-1 |
| flatpak | flatpak | >= 0 < 1.2.3-2 | 1.2.3-2 |
| flatpak | flatpak | >= 0 < 1.14.4-1 | 1.14.4-1 |
| flatpak | flatpak | >= 0 < 1.2.3-2 | 1.2.3-2 |
CVSS provenance
nvdv3.010.0CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv10.0CRITICAL
vendor_debian10.0CRITICAL
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-28100: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux
osv·2023-03-16·CVSS 10.0
CVE-2023-28100 [CRITICAL] CVE-2023-28100: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual
GHSA
GHSA-7vvx-4whv-jg73: The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2
ghsa_unreviewed·2022-05-24·CVSS 10.0
CVE-2020-13753 [CRITICAL] CWE-20 GHSA-7vvx-4whv-jg73: The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.
GHSA
GHSA-mc9j-733x-89cx: Flatpak before 1
ghsa_unreviewed·2022-05-14·CVSS 10.0
CVE-2019-10063 [CRITICAL] CWE-20 GHSA-mc9j-733x-89cx: Flatpak before 1
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.
GHSA
GHSA-m28g-vfcm-85ff: When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push character
ghsa_unreviewed·2022-05-13
CVE-2017-5226 [CRITICAL] CWE-20 GHSA-m28g-vfcm-85ff: When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push character
When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
OSV
CVE-2020-13753: The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2
osv·2020-07-14·CVSS 10.0
CVE-2020-13753 [CRITICAL] CVE-2020-13753: The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.
OSV
CVE-2019-10063: Flatpak before 1
osv·2019-03-26·CVSS 10.0
CVE-2019-10063 [CRITICAL] CVE-2019-10063: Flatpak before 1
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.
OSV
CVE-2017-5226: When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push character
osv·2017-03-29·CVSS 10.0
CVE-2017-5226 [CRITICAL] CVE-2017-5226: When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push character
When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
Red Hat
flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console
vendor_redhat·2023-03-16·CVSS 10.0
CVE-2023-28100 [CRITICAL] CWE-20 flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console
flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.1
Debian
CVE-2023-28100: flatpak - Flatpak is a system for building, distributing, and running sandboxed desktop ap...
vendor_debian·2023·CVSS 10.0
CVE-2023-28100 [CRITICAL] CVE-2023-28100: flatpak - Flatpak is a system for building, distributing, and running sandboxed desktop ap...
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual
Red Hat
webkitgtk: Improper access management to CLONE_NEWUSER and the TIOCSTI ioctl
vendor_redhat·2020-07-10·CVSS 10.0
CVE-2020-13753 [CRITICAL] CWE-284 webkitgtk: Improper access management to CLONE_NEWUSER and the TIOCSTI ioctl
webkitgtk: Improper access management to CLONE_NEWUSER and the TIOCSTI ioctl
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.
A flaw was found in webkitgtk in versions prior to 2.28.3 and in WPE WebKit in versions prior to 2.28.3. The bubblewrap sandbox failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg- desktop-portal, which allows access outside the sandbox. TIOCS
Debian
CVE-2020-13753: webkit2gtk - The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to p...
vendor_debian·2020·CVSS 10.0
CVE-2020-13753 [CRITICAL] CVE-2020-13753: webkit2gtk - The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to p...
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.
Scope: local
bookworm: resolved (fixed in 2.28.3-1)
bullseye: resolved (fixed in 2.28.3-1)
forky: resolved (fixed in 2.28.3-1)
sid: resolved (fixed in 2.28.3-1)
trixie: resolved (fixed in 2.28.3-1)
Red Hat
flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226)
vendor_redhat·2019-03-22·CVSS 10.0
CVE-2019-10063 [CRITICAL] CWE-266 flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226)
flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226)
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.
An incomplete fix for CVE-2017-5226 was found in
Debian
CVE-2019-10063: flatpak - Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allow...
vendor_debian·2019·CVSS 10.0
CVE-2019-10063 [CRITICAL] CVE-2019-10063: flatpak - Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allow...
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.
Scope: local
bookworm: resolved (fixed in 1.2.3-2)
bullseye: resolved (fixed in 1.2.3-2)
forky: resolved (fixed in 1.2.3-
Debian
CVE-2017-5226: bubblewrap - When executing a program via the bubblewrap sandbox, the nonpriv session can esc...
vendor_debian·2017·CVSS 10.0
CVE-2017-5226 [CRITICAL] CVE-2017-5226: bubblewrap - When executing a program via the bubblewrap sandbox, the nonpriv session can esc...
When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
Scope: local
bookworm: resolved (fixed in 0.1.5-2)
bullseye: resolved (fixed in 0.1.5-2)
forky: resolved (fixed in 0.1.5-2)
sid: resolved (fixed in 0.1.5-2)
trixie: resolved (fixed in 0.1.5-2)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-13753 webkitgtk: Improper access management to CLONE_NEWUSER and the TIOCSTI ioctl
bugzilla·2020-09-16·CVSS 10.0
CVE-2020-13753 [CRITICAL] CVE-2020-13753 webkitgtk: Improper access management to CLONE_NEWUSER and the TIOCSTI ioctl
CVE-2020-13753 webkitgtk: Improper access management to CLONE_NEWUSER and the TIOCSTI ioctl
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg- desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal’s input buffer, similar to CVE-2017-5226. Versions affected: WebKitGTK before 2.28.3 and WPE WebKit before 2.28.3.
Discussion:
External References:
https://webkitgtk.org/security/WSA-2020-0006.html
---
Note that RHEL 7 and RHEL 8 are both unaffected (because WebKit is not yet sandboxed in RHEL).
---
This bug is now closed. Further updat
Bugzilla
CVE-2019-10063 flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226) [fedora-all]
bugzilla·2019-04-04·CVSS 10.0
CVE-2019-10063 [CRITICAL] CVE-2019-10063 flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226) [fedora-all]
CVE-2019-10063 flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multipl
Bugzilla
CVE-2019-10063 flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226)
bugzilla·2019-04-04·CVSS 10.0
CVE-2019-10063 [CRITICAL] CVE-2019-10063 flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226)
CVE-2019-10063 flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226)
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.
Upstream issue:
https://github.co
Bugzilla
CVE-2017-5226 bubblewrap: Nonprivileged session can escape to the parent session by using the TIOCSTI ioctl
bugzilla·2017-01-10·CVSS 10.0
CVE-2017-5226 [CRITICAL] CVE-2017-5226 bubblewrap: Nonprivileged session can escape to the parent session by using the TIOCSTI ioctl
CVE-2017-5226 bubblewrap: Nonprivileged session can escape to the parent session by using the TIOCSTI ioctl
When executing a program via the bubblewrap sandbox, the nonpriv
session can escape to the parent session by using the TIOCSTI ioctl to
push characters into the terminal's input buffer, allowing an attacker
to escape the sandbox.
References:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850702
Upstream bugs:
https://github.com/projectatomic/bubblewrap/issues/142
https://github.com/projectatomic/bubblewrap/pull/143
Upstream patch:
https://github.com/projectatomic/bubblewrap/commit/d7fc532c42f0e9bf427923bab85433282b3e5117
Discussion:
Created bubblewrap tracking bugs for this issue:
Affects: epel-7 [bug 1411815]
Affects: fedora-all [bug 1411814]
---
We decided not to cha
Bugzilla
CVE-2017-5226 bubblewrap: Nonprivileged session can escape to the parent session by using the TIOCSTI ioctl [epel-7]
bugzilla·2017-01-10·CVSS 10.0
CVE-2017-5226 [CRITICAL] CVE-2017-5226 bubblewrap: Nonprivileged session can escape to the parent session by using the TIOCSTI ioctl [epel-7]
CVE-2017-5226 bubblewrap: Nonprivileged session can escape to the parent session by using the TIOCSTI ioctl [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
bubb
Bugzilla
CVE-2017-5226 bubblewrap: Nonprivileged session can escape to the parent session by using the TIOCSTI ioctl [fedora-all]
bugzilla·2017-01-10·CVSS 10.0
CVE-2017-5226 [CRITICAL] CVE-2017-5226 bubblewrap: Nonprivileged session can escape to the parent session by using the TIOCSTI ioctl [fedora-all]
CVE-2017-5226 bubblewrap: Nonprivileged session can escape to the parent session by using the TIOCSTI ioctl [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: thi
http://www.openwall.com/lists/oss-security/2020/07/10/1http://www.openwall.com/lists/oss-security/2023/03/17/1http://www.securityfocus.com/bid/97260https://bugzilla.redhat.com/show_bug.cgi?id=1411811https://github.com/projectatomic/bubblewrap/commit/d7fc532c42f0e9bf427923bab85433282b3e5117https://github.com/projectatomic/bubblewrap/issues/142https://www.openwall.com/lists/oss-security/2023/03/14/2http://www.openwall.com/lists/oss-security/2020/07/10/1http://www.openwall.com/lists/oss-security/2023/03/17/1http://www.securityfocus.com/bid/97260https://bugzilla.redhat.com/show_bug.cgi?id=1411811https://github.com/projectatomic/bubblewrap/commit/d7fc532c42f0e9bf427923bab85433282b3e5117https://github.com/projectatomic/bubblewrap/issues/142https://www.openwall.com/lists/oss-security/2023/03/14/2
2017-03-29
Published