Name of the Vulnerable Software and Affected Versions birdcage (affected versions not specified)

Description The issue allows environment variables to be read from procfs unless a new process is started. This can be demonstrated through a proof of concept that shows how a secret environment variable can be accessed. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the use of the /proc/self/environ endpoint to read environment variables, and the environ variable is used to store the contents of this file. The env::var os function is used to check if a secret environment variable is set.

Recommendations As a temporary workaround, consider modifying birdcage's API to always spawn a new process when creating a new command, and utilizing ptrace isolation to reinforce guarantees. Additionally, using an additional PID namespace could further reinforce these guarantees. At the moment, there is no information about a newer version that contains a fix for this vulnerability.