Input validation error in WebKitGTK+ and WPE WebKit - CVE-2020-13753

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32874

Input validation error in WebKitGTK+ and WPE WebKit - CVE-2020-13753

Published: July 14, 2020 / Updated: August 2, 2020


Vulnerability identifier: #VU32874
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-13753
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.


Affected software

WebKitGTK+
WPE WebKit
Gentoo Linux
Debian Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Module for Basesystem
Opensuse
Ubuntu
Fedora
webkit2gtk (Alpine package)
libjavascriptcoregtk-4.0-18 (Ubuntu package)
libwebkit2gtk-4.0-37 (Ubuntu package)
webkit2gtk3
webkit2gtk (Debian package)
libjavascriptcoregtk-4_0-18-debuginfo
libwebkit2gtk-4_0-37
libwebkit2gtk-4_0-37-debuginfo
typelib-1_0-JavaScriptCore-4_0
typelib-1_0-WebKit2-4_0
typelib-1_0-WebKit2WebExtension-4_0
webkit2gtk-4_0-injected-bundles
webkit2gtk-4_0-injected-bundles-debuginfo
webkit2gtk3-debugsource
libwebkit2gtk3-lang
webkit2gtk3-devel
libjavascriptcoregtk-4_0-18
webkitgtk4 (Red Hat package)

How to mitigate CVE-2020-13753

Install update from vendor's website.

WebKitGTK+ - update to 2.28.3
WPE WebKit - update to 2.28.3
webkit2gtk (Alpine package) - update to 2.28.3-r0
libjavascriptcoregtk-4.0-18 (Ubuntu package) - addressed in versions 2.28.3-0ubuntu0.18.04.1, 2.28.3-0ubuntu0.19.10.1, 2.28.3-0ubuntu0.20.04.1, 2.30.3-0ubuntu0.18.04.1, 2.30.3-0ubuntu0.20.04.1, 2.30.3-0ubuntu0.20.10.1
libwebkit2gtk-4.0-37 (Ubuntu package) - addressed in versions 2.28.3-0ubuntu0.18.04.1, 2.28.3-0ubuntu0.19.10.1, 2.28.3-0ubuntu0.20.04.1, 2.30.3-0ubuntu0.18.04.1, 2.30.3-0ubuntu0.20.04.1, 2.30.3-0ubuntu0.20.10.1
webkit2gtk3 - addressed in versions 2.28.3-1.fc31, 2.28.3-1.fc32
webkit2gtk (Debian package) - update to 2.28.3-2~deb10u1
libjavascriptcoregtk-4_0-18-debuginfo - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
libwebkit2gtk-4_0-37 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
libwebkit2gtk-4_0-37-debuginfo - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
typelib-1_0-JavaScriptCore-4_0 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
typelib-1_0-WebKit2-4_0 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
typelib-1_0-WebKit2WebExtension-4_0 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
webkit2gtk-4_0-injected-bundles - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
webkit2gtk-4_0-injected-bundles-debuginfo - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
webkit2gtk3-debugsource - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
libwebkit2gtk3-lang - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
webkit2gtk3-devel - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
libjavascriptcoregtk-4_0-18 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
webkitgtk4 (Red Hat package) - update to 2.48.3-2.el7_9

External References

Related Security Bulletins