CVE-2021-42762

· MEDIUMModified

← All CVEs

CVSS v3.1

5.3

EPSS

0.50%

Published

Oct 20, 2021

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected Products (7)

webkitgtk · webkitgtk (up to 2.34.1)vulnerable

wpewebkit · wpe_webkit (up to 2.34.1)vulnerable

fedoraproject · fedoravulnerable

debian · debian_linuxvulnerable

References (20)

http://www.openwall.com/lists/oss-security/2021/10/26/9

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/27/1

Mailing ListThird Party Advisory