PT-2026-35169 · Unknown · Bubblewrap
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
bubblewrap versions 0.11.0 through 0.11.1
Description
A flaw exists in bubblewrap, a low-level unprivileged sandboxing tool, when operating in setuid mode. A local user can use
ptrace to attach to the process and control the unprivileged portion of the sandbox setup phase. This allows the attacker to bypass intended sandboxing restrictions and execute privileged operations that are normally restricted, specifically the creation of overlay mounts. This could potentially lead to privilege escalation on the system.Recommendations
Update to version 0.11.2.
Exploit
Fix
LPE
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bubblewrap