CVE-2016-10117: High severity Firejail Project Firejail vulnerability
Firejail does not restrict access to --tmpfs, which allows local users to gain privileges, as demonstrated by mounting over /etc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firejailto a version that resolves this vulnerability.Fixed in 0.9.38-1 - Upgrade
Upgrade
debian/firejailto a version that resolves this vulnerability.Fixed in 0.9.72-2Fixed in 0.9.74-1Fixed in 0.9.80-2
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10117?
CVE-2016-10117 has a medium severity level, indicating potential privilege escalation risks.
How do I fix CVE-2016-10117?
To fix CVE-2016-10117, it is recommended to update Firejail to the latest version that restricts access to --tmpfs.
Who is affected by CVE-2016-10117?
Local users on systems using affected versions of Firejail are at risk from CVE-2016-10117.
What kind of attack does CVE-2016-10117 vulnerability allow?
CVE-2016-10117 allows local users to gain elevated privileges by improperly mounting over critical directories, like /etc.
Is there a workaround for CVE-2016-10117?
A possible workaround for CVE-2016-10117 is to restrict user access to certain mount privileges in Firejail's configuration.