CVE-2021-26910
Debian Security Advisory 4849-1
Severity Score
7.0
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
3
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.
Firejail versiones anteriores a 0.9.64.4, permite a atacantes omitir las restricciones de acceso previstas porque se presenta una condición de carrera TOCTOU entre una operación de estadística y una operación de montaje OverlayFS
Roman Fiedler discovered that a race condition existed in Firejail when using OverlayFS to prevent writes to the underlying file system. A local attacker could use this to gain administrative privileges. Note: this update disables support for OverlayFS in Firejail.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-02-08 CVE Reserved
- 2021-02-08 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| https://github.com/netblue30/firejail/releases/tag/0.9.64.4 | Release Notes | |
| https://lists.debian.org/debian-lts-announce/2021/02/msg00015.html | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b | 2022-05-23 |
| URL | Date | SRC |
|---|---|---|
| https://security.gentoo.org/glsa/202105-19 | 2022-05-23 | |
| https://www.debian.org/security/2021/dsa-4849 | 2022-05-23 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Firejail Project Search vendor "Firejail Project" | Firejail Search vendor "Firejail Project" for product "Firejail" | < 0.9.64.4 Search vendor "Firejail Project" for product "Firejail" and version " < 0.9.64.4" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||