CVE-2021-42762
First published: Wed Oct 20 2021(Updated: )
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/webkit2gtk | 2.36.4-1~deb10u1 2.38.6-0+deb10u1 2.40.5-1~deb11u1 2.42.1-1~deb11u2 2.40.5-1~deb12u1 2.42.1-1~deb12u1 2.42.1-2 | |
| debian/wpewebkit | 2.38.6-1~deb11u1 2.38.6-1 2.42.1-1 | |
| WebKitGTK WebKitGTK | <2.34.1 | |
| Wpewebkit Wpe Webkit | <2.34.1 | |
| Fedoraproject Fedora | =33 | |
| Fedoraproject Fedora | =34 | |
| Fedoraproject Fedora | =35 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.webkit.org/show_bug.cgi?id=231479
- https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
- https://security-tracker.debian.org/tracker/CVE-2021-42762
- http://www.openwall.com/lists/oss-security/2021/10/26/9
- http://www.openwall.com/lists/oss-security/2021/10/27/1
- http://www.openwall.com/lists/oss-security/2021/10/27/2
- http://www.openwall.com/lists/oss-security/2021/10/27/4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/
- https://www.debian.org/security/2021/dsa-4995
- https://www.debian.org/security/2021/dsa-4996
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-42762.
What is the severity of CVE-2021-42762?
The severity of CVE-2021-42762 is medium with a severity value of 5.3.
Which software is affected by CVE-2021-42762?
The software affected by CVE-2021-42762 includes WebKitGTK version up to 2.34.1, WPE WebKit version up to 2.34.1, webkit2gtk package on Debian, and wpewebkit package on Debian.
How can the vulnerability be exploited?
The vulnerability can be exploited by a sandboxed process tricking host processes into thinking it is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace.
How can CVE-2021-42762 be fixed?
To fix CVE-2021-42762, it is recommended to update to the patched versions of WebKitGTK (2.36.4-1~deb10u1 and later) and WPE WebKit (2.38.6-1~deb11u1 and later), or the latest available versions.
- collector/security-tracker-debian
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- package-manager/debian
- vendor/webkitgtk
- canonical/webkitgtk webkitgtk
- vendor/wpewebkit
- canonical/wpewebkit wpe webkit
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/33
- version/fedoraproject fedora/34
- version/fedoraproject fedora/35
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0