When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3881:02 advisory.

    * flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226) (CVE-2019-10063)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session
    by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to
    escape the sandbox. (CVE-2017-5226)

Security Fix(es) :

  - flatpak: Sandbox bypass via IOCSTI (incomplete fix for     CVE-2017-5226) (CVE-2019-10063)

ID	Name	Product	Family	Type	Severity
289000	MiracleLinux 7 : flatpak-1.0.2-5.el7 (AXSA:2019-3881:02)	Nessus	Miracle Linux Local Security Checks	Local	critical
400901	Alpine: multiple bubblewrap packages: security update to 0.1.5-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
400901	Alpine: multiple bubblewrap packages: security update to 0.1.5-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
124705	Scientific Linux Security Update : flatpak on SL7.x x86_64 (20190508)	Nessus	Scientific Linux Local Security Checks	Local	critical

Detections

Analytics

CVE-2017-5226

critical

Tenable Plugins

critical

critical

critical

critical