Jan Bramkamp

**Name of the Vulnerable Software and Affected Versions** NetApp Products (affected versions not specified) **Description** When fdescfs(4) is mounted in a jail using the "nodup" option, opening the '/dev/fd/N' endpoint returns a descriptor that fails to inherit the Capsicum capability rights or the `FD RESOLVE BENEATH` flag of descriptor `N`. A process within a jail that has obtained a directory file descriptor from another jail can exploit this behavior to bypass the filesystem root restrictions of the jail and escape it. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NetApp Products (affected versions not specified) **Description** The `renameat(2)` function fails to enforce `FD RESOLVE BENEATH` on its directory arguments. This allows a jailed process to rename a directory relative to a restricted descriptor and subsequently escape the jail root using `fchdir(2)`. This exploit is possible if the directory is located on a filesystem that is also reachable from the jail root. Additionally, a process within a jail that has obtained a directory file descriptor from another jail can utilize these techniques to bypass the filesystem root restriction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NetApp Products (affected versions not specified) **Description** An issue exists where SCM RIGHTS file descriptor passing fails to preserve the FD RESOLVE BENEATH restriction during descriptor transfer. A process can bypass this restriction by sending the descriptor to itself via a Unix domain socket. This allows a process within a jail that has received a directory file descriptor from another jail to escape the filesystem root restriction of the jail. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.