CVE-2017-5226

Published: Mar 29, 2017Modified: May 13, 2026

10.0

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: NVD

Description

When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.

Affected (1)

Products: Projectatomic: Bubblewrap

Projectatomic

1 product

Bubblewrap

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Projectatomic Bubblewrap	Up to 0.1.5

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (14)

http://www.openwall.com/lists/oss-security/2020/07/10/1

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2023/03/17/1

Source: cve@mitre.org

http://www.securityfocus.com/bid/97260

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=1411811

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/projectatomic/bubblewrap/commit/d7fc532c42f0e9bf427923bab85433282b3e5117

Source: cve@mitre.org

Patch

https://github.com/projectatomic/bubblewrap/issues/142

Source: cve@mitre.org

ExploitPatchVendor Advisory

https://www.openwall.com/lists/oss-security/2023/03/14/2

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2020/07/10/1