Vulnerability Details : CVE-2017-5226
Potential exploit
When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
Vulnerability category: Input validation
Products affected by CVE-2017-5226
- cpe:2.3:a:projectatomic:bubblewrap:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-5226
7.20%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 91 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-5226
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
10.0
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
3.9
|
6.0
|
NIST |
CWE ids for CVE-2017-5226
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5226
-
https://github.com/projectatomic/bubblewrap/commit/d7fc532c42f0e9bf427923bab85433282b3e5117
Call setsid() before executing sandboxed code (CVE-2017-5226) · projectatomic/bubblewrap@d7fc532 · GitHubPatch
-
https://github.com/projectatomic/bubblewrap/issues/142
CVE-2017-5226 -- bubblewrap escape via TIOCSTI ioctl · Issue #142 · projectatomic/bubblewrap · GitHubExploit;Patch;Vendor Advisory
-
http://www.openwall.com/lists/oss-security/2020/07/10/1
oss-security - WebKitGTK and WPE WebKit Security Advisory WSA-2020-0006
-
http://www.securityfocus.com/bid/97260
Bubblewrap CVE-2017-5226 Security Bypass VulnerabilityThird Party Advisory;VDB Entry
-
http://www.openwall.com/lists/oss-security/2023/03/17/1
oss-security - flatpak: CVE-2023-28100: TIOCLINUX can send commands outside sandbox if running on a virtual console
-
https://bugzilla.redhat.com/show_bug.cgi?id=1411811
1411811 – (CVE-2017-5226) CVE-2017-5226 bubblewrap: Nonprivileged session can escape to the parent session by using the TIOCSTI ioctlIssue Tracking;Patch
-
https://www.openwall.com/lists/oss-security/2023/03/14/2
oss-security - TTY pushback vulnerabilities / TIOCSTI
Jump to