REDHAT-BUG-2016673: Medium severity WebKit WebKitGTK vulnerability
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
References: https://bugs.webkit.org/showbug.cgi?id=231479 https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2016673?
The severity of REDHAT-BUG-2016673 is rated as high due to the potential for a sandbox bypass.
How do I fix REDHAT-BUG-2016673?
To fix REDHAT-BUG-2016673, upgrade to WebKitGTK and WPE WebKit version 2.34.1 or later.
What systems are affected by REDHAT-BUG-2016673?
REDHAT-BUG-2016673 affects WebKitGTK and WPE WebKit prior to version 2.34.1.
What is the impact of REDHAT-BUG-2016673?
The impact of REDHAT-BUG-2016673 is that it allows a sandboxed process to mislead host processes about its confinement status.
Is there a public exploit for REDHAT-BUG-2016673?
As of now, there is no public exploit available for REDHAT-BUG-2016673, but the vulnerability is concerning.