CVE-2021-26910 - Vulnerability Details - OpenCVE

Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Debian	Debian Linux
Firejail Project	Firejail

Configuration 1 [-]

cpe:2.3:a:firejail_project:firejail:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:o:debian:debian_linux:9.0:::::::*
	cpe:2.3:o:debian:debian_linux:10.0:::::::*

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2021/02/09/1
https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b
https://github.com/netblue30/firejail/releases/tag/0.9.64.4
https://lists.debian.org/debian-lts-announce/2021/02/msg00015.html
https://security.gentoo.org/glsa/202105-19
https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/
https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt
https://www.debian.org/security/2021/dsa-4849

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-02-08T19:56:38

Updated: 2024-08-03T20:33:41.306Z

Reserved: 2021-02-08T00:00:00

Link: CVE-2021-26910

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-02-08T20:15:13.090

Modified: 2024-11-21T05:57:01.223

Link: CVE-2021-26910

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-05-26T10:06:18", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b"}, {"tags": ["x_refsource_MISC"], "url": "https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt"}, {"tags": ["x_refsource_MISC"], "url": "https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/netblue30/firejail/releases/tag/0.9.64.4"}, {"name": "[oss-security] 20210209 Re: [cve-pending] Firejail: root privilege escalation in OverlayFS code", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2021/02/09/1"}, {"name": "DSA-4849", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2021/dsa-4849"}, {"name": "[debian-lts-announce] 20210211 [SECURITY] [DLA 2554-1] firejail security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00015.html"}, {"name": "GLSA-202105-19", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/202105-19"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-26910", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b", "refsource": "MISC", "url": "https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b"}, {"name": "https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt", "refsource": "MISC", "url": "https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt"}, {"name": "https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/", "refsource": "MISC", "url": "https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/"}, {"name": "https://github.com/netblue30/firejail/releases/tag/0.9.64.4", "refsource": "MISC", "url": "https://github.com/netblue30/firejail/releases/tag/0.9.64.4"}, {"name": "[oss-security] 20210209 Re: [cve-pending] Firejail: root privilege escalation in OverlayFS code", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2021/02/09/1"}, {"name": "DSA-4849", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2021/dsa-4849"}, {"name": "[debian-lts-announce] 20210211 [SECURITY] [DLA 2554-1] firejail security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00015.html"}, {"name": "GLSA-202105-19", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/202105-19"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T20:33:41.306Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/netblue30/firejail/releases/tag/0.9.64.4"}, {"name": "[oss-security] 20210209 Re: [cve-pending] Firejail: root privilege escalation in OverlayFS code", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2021/02/09/1"}, {"name": "DSA-4849", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2021/dsa-4849"}, {"name": "[debian-lts-announce] 20210211 [SECURITY] [DLA 2554-1] firejail security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00015.html"}, {"name": "GLSA-202105-19", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/202105-19"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-26910", "datePublished": "2021-02-08T19:56:38", "dateReserved": "2021-02-08T00:00:00", "dateUpdated": "2024-08-03T20:33:41.306Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:firejail_project:firejail:*:*:*:*:*:*:*:*", "matchCriteriaId": "4457E838-C33E-4AEA-842B-8A155CC63213", "versionEndExcluding": "0.9.64.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation."}, {"lang": "es", "value": "Firejail versiones anteriores a 0.9.64.4, permite a atacantes omitir las restricciones de acceso previstas porque se presenta una condici\u00f3n de carrera TOCTOU entre una operaci\u00f3n de estad\u00edstica y una operaci\u00f3n de montaje OverlayFS"}], "id": "CVE-2021-26910", "lastModified": "2024-11-21T05:57:01.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-02-08T20:15:13.090", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/02/09/1"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/netblue30/firejail/releases/tag/0.9.64.4"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00015.html"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202105-19"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2021/dsa-4849"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/02/09/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/netblue30/firejail/releases/tag/0.9.64.4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00015.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202105-19"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2021/dsa-4849"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "nvd@nist.gov", "type": "Primary"}]}