oss-security - [cve-pending] Firejail: root privilege escalation in OverlayFS code

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <NKuWiXQK3sAwyMdDQT07Bdnnl5XSSBmKbvUMqaIhhCSShwaQMmOUKOVT9TCVVDGv43RDuHjy42O3GILwnaZiA2dadJ42Mqn09BhGaGu8BhE=@protonmail.com>
Date: Mon, 08 Feb 2021 14:15:05 +0000
From: netblue30 <netblue30@...tonmail.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: [cve-pending] Firejail: root privilege escalation in OverlayFS code

Security Advisory - Feb 8, 2021

Summary: A vulnerability resulting in root privilege escalation was discovered in Firejail's OverlayFS code,

Versions affected: Firejail software versions starting with 0.9.30.
Long Term Support (LTS) Firejail branch is not affected by this bug.

Workaround: Disable overlayfs feature at runtime. In a text editor open /etc/firejail/firejail.config file,
and set "overlayfs" entry to "no".

      $ grep overlayfs /etc/firejail/firejail.config
      # Enable or disable overlayfs features, default enabled.
      overlayfs no

Fix: The bug is fixed in Firejail version 0.9.64.4

GitHub commit: (file configure.ac)
https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b

Credit:  Security researcher Roman Fiedler analyzed the code and discovered the vulnerability.
Functional PoC exploit code was provided to Firejail development team.
A description of the problem is here on Roman's blog:

https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt
https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/

Regards,

netblue30
(https://github.com/netblue30/firejail)

Sent with ProtonMail Secure Email.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.