Lucene search

K
rosalinuxROSA LABROSA-SA-2023-2289
HistoryNov 07, 2023 - 9:51 a.m.

Advisory ROSA-SA-2023-2289

2023-11-0709:51:32
ROSA LAB
abf.rosalinux.ru
9
firejail
rosa-chrome
vulnerability
overlayfs
suid
exploitation
sensitive data
integrity
denial-of-service

6.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

29.7%

software: firejail 0.9.60
WASP: ROSA-CHROME

package_evr_string: firejail-0.9.60-1.src.rpm

CVE-ID: CVE-2021-26910
BDU-ID: 2021-03745
CVE-Crit: HIGH
CVE-DESC.: A vulnerability in the OverlayFS SUID component of the Firejail sandbox is related to insufficient state checking of a shared resource. Exploitation of the vulnerability could allow an attacker to gain access to sensitive data, compromise its integrity, and cause a denial-of-service condition
CVE-STATUS: Resolved
CVE-REV: To close, run the command: sudo dnf update firejail

OSVersionArchitecturePackageVersionFilename
ROSAanynoarchfirejail< 0.9.60UNKNOWN

6.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

29.7%