Executive brief
Firejail is a security tool used to isolate applications in a 'sandbox' to prevent them from accessing sensitive parts of the system. A vulnerability was found that allows a user running a program inside this sandbox to break out and execute commands on the host system. This could allow an attacker to bypass security restrictions and gain full control over the computer.
Technical details
Firejail is vulnerable to a sandbox escape via the TIOCSTI ioctl call. A local attacker can use this ioctl to push malicious characters into the terminal's input buffer (the parent's TTY). When the sandboxed process exits or the user interacts with the terminal, these injected characters are executed as commands in the context of the parent session, outside the sandbox. This vulnerability is a result of improper terminal isolation. The issue was addressed in version 0.9.44 by implementing better TTY handling.
Affected products
- Firejail Project Firejail 0.9.38.4 and earlier versions before 0.9.44
Timeline
- 2016-10-25: disclosed: Vulnerability discussed on oss-security mailing list
- 2016-10-25: patched: Fix identified in Firejail version 0.9.44 via GitHub commit 46dc2b34f1fbbc4597b4ff9f6a3cb28b2d500d1b
- 2017-01-19: advisory: NVD advisory published