CVE-2020-5291
📋 TL;DR
This vulnerability in Bubblewrap (bwrap) allows local attackers to gain root privileges when the software is installed in setuid mode and the kernel supports unprivileged user namespaces. By using the --userns2 option, attackers can trace the setuid process running as root and escalate privileges. This primarily affects specific Linux distributions with non-default configurations.
💻 Affected Systems
- Bubblewrap (bwrap)
📦 What is this software?
Arch Linux by Archlinux
Bubblewrap by Projectatomic
Centos by Centos
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full root privileges on the system, enabling complete system compromise, data theft, persistence, and lateral movement.
Likely Case
Local user with shell access escalates to root privileges, gaining full control over the affected system.
If Mitigated
No privilege escalation possible; attacker remains confined to their original user permissions.
🎯 Exploit Status
Exploit requires local shell access. The vulnerability is well-documented with technical details available in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.1
Vendor Advisory: https://github.com/containers/bubblewrap/security/advisories/GHSA-j2qp-rvxj-43vj
Restart Required: No
Instructions:
1. Update bubblewrap to version 0.4.1 or later using your distribution's package manager. 2. For Debian testing/unstable: apt update && apt upgrade bubblewrap. 3. For Arch: pacman -Syu bubblewrap. 4. For CentOS 7 COPR: yum update bubblewrap.
🔧 Temporary Workarounds
Disable unprivileged user namespaces
linuxPrevents the vulnerability by disabling the kernel feature required for exploitation
echo 'kernel.unprivileged_userns_clone=0' > /etc/sysctl.d/disable-userns.conf
sysctl -p /etc/sysctl.d/disable-userns.conf
Remove setuid bit from bubblewrap
linuxRemoves the setuid privilege that enables the vulnerability
chmod u-s $(which bwrap)
🧯 If You Can't Patch
- Apply workaround to disable unprivileged user namespaces
- Remove setuid bit from bubblewrap binary
- Restrict user access to systems with vulnerable configurations
🔍 How to Verify
Check if Vulnerable:
Check if bubblewrap version is <0.4.1 AND has setuid bit set: ls -la $(which bwrap) | grep '^...s' AND check if unprivileged user namespaces are enabled: sysctl kernel.unprivileged_userns_cloneCheck Version:
bwrap --versionVerify Fix Applied:
Verify bubblewrap version is >=0.4.1: bwrap --version📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts
- Processes running bwrap with --userns2 flag
- Failed setuid operations
Network Indicators:
- None - this is a local privilege escalation
SIEM Query:
process.name:"bwrap" AND process.args:"--userns2"🔗 References
- https://github.com/containers/bubblewrap/commit/1f7e2ad948c051054b683461885a0215f1806240
- https://github.com/containers/bubblewrap/security/advisories/GHSA-j2qp-rvxj-43vj
- https://github.com/containers/bubblewrap/commit/1f7e2ad948c051054b683461885a0215f1806240
- https://github.com/containers/bubblewrap/security/advisories/GHSA-j2qp-rvxj-43vj
