CVE-2019-12439: Input Validation
bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDGRUNTIMEDIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.
Other sources
Is /run/user/<UID>/.bubblewrap/ doesn't exist and couldn't be created (as was the case on my system), bubblewrap falls back to /tmp/.bubblewrap-<UID>/. Local attacker could exploit this to prevent other users from running bubblewrap, for example:
getent passwd | cut -d: -f3 | xargs printf '/tmp/.bubblewrap-%d\n' | xargs touch
But it gets worse, because bubblewrap is happy to use existing /tmp/.bubblewrap-<UID>/, even when the directory is owned by some else. In the worst case, this could be exploited by a local user to execute arbitrary code in the container. (Though I couldn't find any way to exploit this without disabling protectedsymlinks.)
Upstream issue:
https://github.com/projectatomic/bubblewrap/issues/304
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/bubblewrapto a version that resolves this vulnerability.Fixed in 0.3.3 - Upgrade
Upgrade
debian/bubblewrapto a version that resolves this vulnerability.Fixed in 0.8.0-2+deb12u1Fixed in 0.12.0-1~deb13u1Fixed in 0.12.0-1 - Upgrade
Upgrade
bubblewrapto a version that resolves this vulnerability.Fixed in 0.3.3 - Compensating control
Ensure per-user runtime directory exists and is accessible: create /run/user/<UID>/.bubblewrap/ if it does not exist (e.g., on systems using XDG_RUNTIME_DIR) so bubblewrap does not fall back to /tmp/.bubblewrap-<UID>/.