CVE-2020-5291

See a problem?

Source

https://nvd.nist.gov/vuln/detail/CVE-2020-5291

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5291.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-5291

Aliases

GHSA-j2qp-rvxj-43vj

Related

openSUSE-SU-2024:10663-1

Published

2020-03-31T18:15:26Z

Modified

2024-09-03T03:35:28.857741Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the bwrap --userns2 option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using linux-hardened, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.

References

Affected packages

Alpine:v3.11 / bubblewrap

Package

Name: bubblewrap
Purl: pkg:apk/alpine/bubblewrap?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-r0

Affected versions

0.*

0.1.5-r0

0.1.5-r1

0.1.7-r0

0.1.8-r0

0.2.0-r0

0.2.0-r1

0.2.1-r0

0.3.0-r0

0.3.1-r0

0.3.3-r0

0.4.0-r0

Alpine:v3.12 / bubblewrap

Package

Name: bubblewrap
Purl: pkg:apk/alpine/bubblewrap?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-r0

Affected versions

0.*

0.1.5-r0

0.1.5-r1

0.1.7-r0

0.1.8-r0

0.2.0-r0

0.2.0-r1

0.2.1-r0

0.3.0-r0

0.3.1-r0

0.3.3-r0

0.4.0-r0

Alpine:v3.13 / bubblewrap

Package

Name: bubblewrap
Purl: pkg:apk/alpine/bubblewrap?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-r0

Affected versions

0.*

0.1.5-r0

0.1.5-r1

0.1.7-r0

0.1.8-r0

0.2.0-r0

0.2.0-r1

0.2.1-r0

0.3.0-r0

0.3.1-r0

0.3.3-r0

0.4.0-r0

Alpine:v3.14 / bubblewrap

Package

Name: bubblewrap
Purl: pkg:apk/alpine/bubblewrap?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-r0

Affected versions

0.*

0.1.5-r0

0.1.5-r1

0.1.7-r0

0.1.8-r0

0.2.0-r0

0.2.0-r1

0.2.1-r0

0.3.0-r0

0.3.1-r0

0.3.3-r0

0.4.0-r0

Alpine:v3.15 / bubblewrap

Package

Name: bubblewrap
Purl: pkg:apk/alpine/bubblewrap?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-r0

Affected versions

0.*

0.1.5-r0

0.1.5-r1

0.1.7-r0

0.1.8-r0

0.2.0-r0

0.2.0-r1

0.2.1-r0

0.3.0-r0

0.3.1-r0

0.3.3-r0

0.4.0-r0

Alpine:v3.16 / bubblewrap

Package

Name: bubblewrap
Purl: pkg:apk/alpine/bubblewrap?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-r0

Affected versions

0.*

0.1.5-r0

0.1.5-r1

0.1.7-r0

0.1.8-r0

0.2.0-r0

0.2.0-r1

0.2.1-r0

0.3.0-r0

0.3.1-r0

0.3.3-r0

0.4.0-r0

Alpine:v3.17 / bubblewrap

Package

Name: bubblewrap
Purl: pkg:apk/alpine/bubblewrap?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-r0

Affected versions

0.*

0.1.5-r0

0.1.5-r1

0.1.7-r0

0.1.8-r0

0.2.0-r0

0.2.0-r1

0.2.1-r0

0.3.0-r0

0.3.1-r0

0.3.3-r0

0.4.0-r0

Alpine:v3.18 / bubblewrap

Package

Name: bubblewrap
Purl: pkg:apk/alpine/bubblewrap?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-r0

Affected versions

0.*

0.1.5-r0

0.1.5-r1

0.1.7-r0

0.1.8-r0

0.2.0-r0

0.2.0-r1

0.2.1-r0

0.3.0-r0

0.3.1-r0

0.3.3-r0

0.4.0-r0

Alpine:v3.19 / bubblewrap

Package

Name: bubblewrap
Purl: pkg:apk/alpine/bubblewrap?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-r0

Affected versions

0.*

0.1.5-r0

0.1.5-r1

0.1.7-r0

0.1.8-r0

0.2.0-r0

0.2.0-r1

0.2.1-r0

0.3.0-r0

0.3.1-r0

0.3.3-r0

0.4.0-r0

Alpine:v3.20 / bubblewrap

Package

Name: bubblewrap
Purl: pkg:apk/alpine/bubblewrap?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-r0

Affected versions

0.*

0.1.5-r0

0.1.5-r1

0.1.7-r0

0.1.8-r0

0.2.0-r0

0.2.0-r1

0.2.1-r0

0.3.0-r0

0.3.1-r0

0.3.3-r0

0.4.0-r0

Debian:11 / bubblewrap

Package

Name: bubblewrap
Purl: pkg:deb/debian/bubblewrap?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-1

Ecosystem specific

{
    "urgency": "low"
}

Debian:12 / bubblewrap

Package

Name: bubblewrap
Purl: pkg:deb/debian/bubblewrap?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-1

Ecosystem specific

{
    "urgency": "low"
}

Debian:13 / bubblewrap

Package

Name: bubblewrap
Purl: pkg:deb/debian/bubblewrap?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-1

Ecosystem specific

{
    "urgency": "low"
}

Git / github.com/containers/bubblewrap

Affected ranges

Type: GIT
Repo: https://github.com/containers/bubblewrap
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

1f7e2ad948c051054b683461885a0215f1806240

Type: GIT
Repo: https://github.com/projectatomic/bubblewrap
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

5feb64dc60c936a7f9e424df9478aae9b88ee48a

Affected versions

0.*

0.1.2

v0.*

v0.1.0

v0.1.1

v0.1.3

v0.1.4

v0.1.5

v0.1.7

v0.1.8

v0.2.0

v0.2.1

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.4.0