Re: Re: Firejail local root exploit

[Marcus Meissner <meissner () suse de>]

Hi Mitre,

On Wed, Jan 04, 2017 at 12:16:49PM -0500, cve-assign () mitre org wrote:
> >  * Firejail has too broad attack surface that allows users
> >  * to specify a lot of options, where one of them eventually
> >  * broke by accessing user-files while running with euid 0.
>
> > const char *const ldso = "/etc/ld.so.preload";
> > ...
> > snprintf(path, sizeof(path) - 1, "%s/.firenail/.Xauthority", home);
> > ...
> > symlink(ldso, path)
>
> Use CVE-2017-5180.

Is this correct? It starts quite far into the 2017 namespace?

Or have other CNAs allocated the previous 5000 ?

Ciao, Marcus