34
Discussion of CVE-2017-5226 (lemmy.zip)
submitted 4 months ago* (last edited 4 months ago) by possiblylinux127@lemmy.zip to c/linux@lemmy.ml
13 comments fedilink hide all child comments

CVE-2017-5226 is a issue with bubblewrap that allows a program running in a sandbox to excape and get the same privileges as a the parent process. I recently discovered this by mistake and it is fairly concerning to me. ~~I believe it applies to Flatpak as Flatpak uses bubblewrap under the hood.~~

~~Many people like to boast about how secure and private flatpak and some even run untrusted software in it. However, the reality is that there hasn't been a lot of testing and the fact that this CVE still exists but isn't well known is concerning.~~

The reason it wasn't patched is that it is really hard to properly fix. The work around is to call bubblewrap with the --new-session flag as this effectively prevents the excape. However, this breaks interactive programs such as htop. Also the bubblewrap team believes this is a issue that should be solved downstream as this CVE is technically not a CVE in the traditional sense.

I think it is still better to run flatpak over non flatpak but it is something to be aware of

Edit:

It doesn't apply to flatpak as it is patched in 1.3.1and higher https://github.com/flatpak/flatpak/security/advisories/GHSA-7gfv-rvfx-h87x

Basically this is a communication and people problem not a technical one

Edit2:

This isn't exploitable on modern systems with 6.1 or newer with the way most distros compile the kernel

you are viewing a single comment's thread
view the rest of the comments
[-] Max_P@lemmy.max-p.me 11 points 4 months ago

It's definitely not perfect, but this also wouldn't affect GUI apps because there's no shell to send inputs into to run other commands. There's also more container escapes than just that.

But it's an added layer of security regardless, especially if you're not directly running software designed to escape the sandbox. A drive by exploit in a browser for example, is less likely to successfully escape because the stars needs to align that you have both a vulnerable browser and a vulnerable kernel at the same time.

The average credential stealer or NPM malware is likely to be contained and not even realize it's in a sandbox. You have to get malware and said malware is smart enough to exploit an unpatched CVE in your sandbox.

But no it's not perfect, the only way to safely run malware is on a separate physical machine with no access to your local network, and ideally with no wireless technology at all (to avoid WiFi/Bluetooth exploits). Even VMs can be escaped, there's a few CVEs for that too, and of course the processor bugs.

Security comes in layers, unless a layer is basically useless, it counts.

[-] possiblylinux127@lemmy.zip 3 points 4 months ago

The term you are looking for is security in depth.

I just noticed this when researching bubblewrap

this post was submitted on 15 Jul 2024
34 points (94.7% liked)

Linux

48132 readers
631 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
nooter692@lemmy.ml
AgreeableLandscape@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz