Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using `linux-hardened`, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged
    user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as
    root while being traceable. This can in turn be used to gain root permissions. Note that this only affects
    the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces
    are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian
    testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if
    unprivileged user namespaces enabled (not default) * Arch if using `linux-hardened`, if unprivileged user
    namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not
    default) This has been fixed in the 0.4.1 release, and all affected users should update. (CVE-2020-5291)

An update of the bubblewrap package has been released.

According to the version of the bubblewrap package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Bubblewrap (bwrap) before version 0.4.1, if installed     in setuid mode and the kernel supports unprivileged     user namespaces, then the `bwrap --userns2` option can     be used to make the setuid process keep running as root     while being traceable. This can in turn be used to gain     root permissions. Note that this only affects the     combination of bubblewrap in setuid mode (which is     typically used when unprivileged user namespaces are     not supported) and the support of unprivileged user     namespaces. Known to be affected are: * Debian     testing/unstable, if unprivileged user namespaces     enabled (not default) * Debian buster-backports, if     unprivileged user namespaces enabled (not default) *     Arch if using `linux-hardened`, if unprivileged user     namespaces enabled (not default) * Centos 7 flatpak     COPR, if unprivileged user namespaces enabled (not     default) This has been fixed in the 0.4.1 release, and     all affected users should update.(CVE-2020-5291)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
423728	Alpine: multiple bubblewrap packages: security update to 0.4.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
423728	Alpine: multiple bubblewrap packages: security update to 0.4.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
203093	Photon OS 2.0: Bubblewrap PHSA-2020-2.0-0227	Nessus	PhotonOS Local Security Checks	high
139941	EulerOS 2.0 SP8 : bubblewrap (EulerOS-SA-2020-1838)	Nessus	Huawei Local Security Checks	high
135780	Photon OS 3.0: Bubblewrap PHSA-2020-3.0-0078	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2020-5291

high

Tenable Plugins

high

high

high

high

high