Privilege escalation in Archlinux Arch Linux
CVE-2020-5291
Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using `linux-hardened`, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.
EPSS: 0.009 (57.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Archlinux Arch_linux
- Containers Bubblewrap — versions < 0.4.1
- Projectatomic Bubblewrap
- Centos — versions 7.0
- Debian Debian_linux — versions 10.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory, Mitigation)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-5291?
- CVE-2020-5291 is a high-severity vulnerability in Archlinux Arch Linux, classified under CWE-648. CVSS score: 7.2/10. Published 2020-03-31.
- How severe is CVE-2020-5291?
- High severity. CVSS v3 base score is 7.2 out of 10.