CVE-2021-26910
📋 TL;DR
This vulnerability in Firejail allows attackers to bypass security restrictions through a TOCTOU race condition between stat and OverlayFS mount operations. Attackers can exploit this to gain unauthorized access to files or execute commands outside the intended sandbox. Users of Firejail versions before 0.9.64.4 are affected.
💻 Affected Systems
- Firejail
📦 What is this software?
Firejail by Firejail Project
⚠️ Risk & Real-World Impact
Worst Case
Complete sandbox escape allowing attackers to execute arbitrary code on the host system with the privileges of the Firejail process.
Likely Case
Unauthorized file access or privilege escalation within the host system, potentially leading to data theft or further system compromise.
If Mitigated
Limited impact if Firejail is running with minimal privileges and proper access controls are in place on the host system.
🎯 Exploit Status
Exploitation requires local access and knowledge of the race condition timing. Proof-of-concept details are publicly available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.64.4
Vendor Advisory: https://github.com/netblue30/firejail/releases/tag/0.9.64.4
Restart Required: Yes
Instructions:
1. Update Firejail to version 0.9.64.4 or later using your distribution's package manager. 2. Restart all Firejail processes. 3. For source installations: download from GitHub, compile, and replace existing binary.
🔧 Temporary Workarounds
Disable OverlayFS
linuxTemporarily disable OverlayFS usage in Firejail to prevent exploitation of this race condition.
firejail --disable-overlayfs
🧯 If You Can't Patch
- Restrict Firejail usage to trusted users only
- Run Firejail with minimal privileges using unprivileged user accounts
🔍 How to Verify
Check if Vulnerable:
Check Firejail version with 'firejail --version'. If version is below 0.9.64.4, the system is vulnerable.Check Version:
firejail --versionVerify Fix Applied:
After updating, verify version is 0.9.64.4 or higher with 'firejail --version'.📡 Detection & Monitoring
Log Indicators:
- Unusual OverlayFS mount operations in system logs
- Failed sandbox escape attempts in Firejail logs
Network Indicators:
- None - this is a local privilege escalation vulnerability
SIEM Query:
Search for process execution patterns where Firejail spawns unexpected child processes or accesses files outside sandbox boundaries.🔗 References
- http://www.openwall.com/lists/oss-security/2021/02/09/1
- https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b
- https://github.com/netblue30/firejail/releases/tag/0.9.64.4
- https://lists.debian.org/debian-lts-announce/2021/02/msg00015.html
- https://security.gentoo.org/glsa/202105-19
- https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/
- https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt
- https://www.debian.org/security/2021/dsa-4849
- http://www.openwall.com/lists/oss-security/2021/02/09/1
- https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b
- https://github.com/netblue30/firejail/releases/tag/0.9.64.4
- https://lists.debian.org/debian-lts-announce/2021/02/msg00015.html
- https://security.gentoo.org/glsa/202105-19
- https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/
- https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt
- https://www.debian.org/security/2021/dsa-4849
