BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-10-20T18:15:59

Updated: 2024-08-04T03:38:50.056Z

Reserved: 2021-10-20T00:00:00

Link: CVE-2021-42762

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-10-20T19:15:07.637

Modified: 2024-11-21T06:28:07.307

Link: CVE-2021-42762

cve-icon Redhat

Severity : Moderate

Publid Date: 2021-10-20T00:00:00Z

Links: CVE-2021-42762 - Bugzilla