Permissions, Privileges, and Access Controls in firejail - CVE-2022-31214

Vulnerability identifier: #VU64166

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-31214

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to a privilege context switching issue. A local attacker can gain root privileges through execution of available setuid-root binaries such as su or sudo.

firejail
Gentoo Linux
Fedora
firejail (Debian package)
sys-apps/firejail
firejail

Install updates from vendor's website.

firejail - update to 0.9.70
firejail (Debian package) - addressed in versions 0.9.58.2-2+deb10u3, 0.9.64.4-2+deb11u1
sys-apps/firejail - update to 0.9.70
firejail - addressed in versions 0.9.70-1.fc35, 0.9.70-1.fc36, 0.9.70-1.fc37, 0.9.70-1.fc38

• https://www.openwall.com/lists/oss-security/2022/06/08/10
• https://firejail.wordpress.com/download-2/release-notes/
• https://github.com/netblue30/firejail/releases/tag/0.9.70

• Privilege escalation in firejail
• Debian update for firejail
• Gentoo update for Firejail
• Fedora 38 update for firejail
• Fedora 37 update for firejail
• Fedora 35 update for firejail
• Fedora 36 update for firejail