CVE-2021-42762
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
El archivo BubblewrapLauncher.cpp en WebKitGTK y WPE WebKit versiones anteriores a 2.34.1, permite una omisión limitada del sandbox que permite a un proceso con sandbox engañar a procesos anfitriones para que piensen que el proceso con sandbox no está confinado por la sandbox, al abusar de las llamadas al sistema VFS que manipulan su espacio de nombres del sistema de archivos. El impacto se limita a servicios de host que crean sockets UNIX que WebKit monta dentro de su sandbox, y el proceso con sandbox permanece confinado de otra manera. NOTA: esto es similar a CVE-2021-41133
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-10-20 CVE Reserved
- 2021-10-20 CVE Published
- 2023-11-08 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2021/10/26/9 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2021/10/27/1 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2021/10/27/2 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2021/10/27/4 | Mailing List |
|
| https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://bugs.webkit.org/show_bug.cgi?id=231479 | 2024-08-04 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Webkitgtk Search vendor "Webkitgtk" | Webkitgtk Search vendor "Webkitgtk" for product "Webkitgtk" | < 2.34.1 Search vendor "Webkitgtk" for product "Webkitgtk" and version " < 2.34.1" | - |
Affected
| ||||||
| Wpewebkit Search vendor "Wpewebkit" | Wpe Webkit Search vendor "Wpewebkit" for product "Wpe Webkit" | < 2.34.1 Search vendor "Wpewebkit" for product "Wpe Webkit" and version " < 2.34.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 33 Search vendor "Fedoraproject" for product "Fedora" and version "33" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 34 Search vendor "Fedoraproject" for product "Fedora" and version "34" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 35 Search vendor "Fedoraproject" for product "Fedora" and version "35" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0" | - |
Affected
| ||||||