Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.

The remote host is affected by the vulnerability described in GLSA-202105-19 (Firejail: Privilege escalation)

    It was discovered that a flaw in Firejail&rsquo;s OverlayFS code allowed       restricted programs to escape sandbox.
  Impact :

    A local attacker could obtain arbitrary file system access via an       application running within a Firejail sandbox, possibly resulting in       privilege escalation.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5141-1 advisory.

    Roman Fiedler discovered that a race condition existed in Firejail when using OverlayFS to prevent writes     to the underlying file system. A local attacker could use this to gain administrative privileges. Note:
    this update disables support for OverlayFS in Firejail.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for firejail fixes the following issues :

firejail 0.9.64.4 is shipped to openSUSE Leap 15.2

  - CVE-2021-26910: Fixed root privilege escalation due to     race condition (boo#1181990)

Update to 0.9.64.4 :

  - disabled overlayfs, pending multiple fixes

  - fixed launch firefox for open url in     telegram-desktop.profile

Update to 0.9.64.2 :

  - allow --tmpfs inside $HOME for unprivileged users

  - --disable-usertmpfs compile time option

  - allow AF_BLUETOOTH via --protocol=bluetooth

  - setup guide for new users: contrib/firejail-welcome.sh

  - implement netns in profiles

  - added nolocal6.net IPv6 network filter

  - new profiles: spectacle, chromium-browser-privacy,     gtk-straw-viewer, gtk-youtube-viewer,     gtk2-youtube-viewer, gtk3-youtube-viewer, straw-viewer,     lutris, dolphin-emu, authenticator-rs, servo, npm,     marker, yarn, lsar, unar, agetpkg, mdr, shotwell, qnapi,     new profiles: guvcview, pkglog, kdiff3, CoyIM.

Update to version 0.9.64 :

  - replaced --nowrap option with --wrap in firemon

  - The blocking action of seccomp filters has been changed     from killing the process to returning EPERM to the     caller. To get the previous behaviour, use
    --seccomp-error-action=kill or syscall:kill syntax when     constructing filters, or override in     /etc/firejail/firejail.config file.

  - Fine-grained D-Bus sandboxing with xdg-dbus-proxy.
    xdg-dbus-proxy must be installed, if not D-Bus access     will be allowed. With this version nodbus is deprecated,     in favor of dbus-user none and dbus-system none and will     be removed in a future version.

  - DHCP client support

  - firecfg only fix dektop-files if started with sudo

  - SELinux labeling support

  - custom 32-bit seccomp filter support

  - restrict $(RUNUSER) in several profiles

  - blacklist shells such as bash in several profiles

  - whitelist globbing

  - mkdir and mkfile support for /run/user directory

  - support ignore for include

  - --include on the command line

  - splitting up media players whitelists in     whitelist-players.inc

  - new condition: HAS_NOSOUND

  - new profiles: gfeeds, firefox-x11, tvbrowser, rtv,     clipgrab, muraster

  - new profiles: gnome-passwordsafe, bibtex, gummi, latex,     mupdf-x11-curl

  - new profiles: pdflatex, tex, wpp, wpspdf, wps, et,     multimc, mupdf-x11

  - new profiles: gnome-hexgl,     com.github.johnfactotum.Foliate, mupdf-gl, mutool

  - new profiles: desktopeditors, impressive, planmaker18,     planmaker18free

  - new profiles: presentations18, presentations18free,     textmaker18, teams

  - new profiles: textmaker18free, xournal,     gnome-screenshot, ripperX

  - new profiles: sound-juicer, com.github.dahenson.agenda,     gnome-pomodoro

  - new profiles: gnome-todo, x2goclient, iagno, kmplayer,     penguin-command

  - new profiles: frogatto, gnome-mines, gnome-nibbles,     lightsoff, warmux

  - new profiles: ts3client_runscript.sh, ferdi, abiword,     four-in-a-row

  - new profiles: gnome-mahjongg, gnome-robots,     gnome-sudoku, gnome-taquin

  - new profiles: gnome-tetravex, blobwars,     gravity-beams-and-evaporating-stars

  - new profiles: hyperrogue, jumpnbump-menu, jumpnbump,     magicor, mindless

  - new profiles: mirrormagic, mrrescue, scorched3d-wrapper,     scorchwentbonkers

  - new profiles: seahorse-adventures, wordwarvi, xbill,     gnome-klotski

  - new profiles: swell-foop, fdns, five-or-more,     steam-runtime

  - new profiles: nicotine, plv, mocp, apostrophe,     quadrapassel, dino-im

  - new profiles: hitori, bijiben, gnote, gnubik, ZeGrapher,     xonotic-sdl-wrapper

  - new profiles: gapplication, openarena_ded,     element-desktop, cawbird

  - new profiles: freetube, strawberry, jitsi-meet-desktop

  - new profiles: homebank, mattermost-desktop, newsflash,     com.gitlab.newsflash

  - new profiles: sushi, xfce4-screenshooter,     org.gnome.NautilusPreviewer, lyx

  - new profiles: minitube, nuclear, mtpaint,     minecraft-launcher, gnome-calendar

  - new profiles: vmware, git-cola, otter-browser, kazam,     menulibre, musictube

  - new profiles: onboard, fractal, mirage, quaternion,     spectral, man, psi

  - new profiles: smuxi-frontend-gnome, balsa, kube,     trojita, youtube

  - new profiles: youtubemusic-nativefier, cola, dbus-send,     notify-send

  - new profiles: qrencode, ytmdesktop, twitch

  - new profiles: xournalpp, chromium-freeworld, equalx

  - Make the AppArmor profile compatible with AppArmor 3.0     (add missing include <tunables/global>)

Update to 0.9.62.4

  - fix AppArmor broken in the previous release

  - miscellaneous fixes

Update to 0.9.62.2

  - fix CVE-2020-17367

  - fix CVE-2020-17368

Roman Fiedler discovered a vulnerability in the OverlayFS code in firejail, a sandbox program to restrict the running environment of untrusted applications, which could result in root privilege escalation. This update disables OverlayFS support in firejail.

For Debian 9 stretch, this problem has been fixed in version 0.9.44.8-2+deb9u2.

We recommend that you upgrade your firejail packages.

For the detailed security status of firejail please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/firejail

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Roman Fiedler discovered a vulnerability in the OverlayFS code in firejail, a sandbox program to restrict the running environment of untrusted applications, which could result in root privilege escalation. This update disables OverlayFS support in firejail.

ID	Name	Product	Family	Severity
157007	GLSA-202105-19 : Firejail: Privilege escalation	Nessus	Gentoo Local Security Checks	high
155220	Ubuntu 20.04 LTS : Firejail vulnerability (USN-5141-1)	Nessus	Ubuntu Local Security Checks	high
146524	openSUSE Security Update : firejail (openSUSE-2021-271)	Nessus	SuSE Local Security Checks	critical
146466	Debian DLA-2554-1 : firejail security update	Nessus	Debian Local Security Checks	high
146357	Debian DSA-4849-1 : firejail - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-26910

high

Tenable Plugins

high

high

critical

high

high