A vulnerability (CVE-2022-31214) has been identified in the Firejail application isolation utility, allowing a local user to gain root privileges in the main system. A working exploit has been made publicly available, verified on current releases of openSUSE, Debian, Arch, Gentoo, and Fedora with the firejail utility installed. The issue has been resolved in firejail version 0.9.70. As a workaround for protection, one can set the parameters 'join no' and 'force-nonewprivs yes' in the configuration settings (/etc/firejail/firejail.config).
Firejail uses namespaces, AppArmor, and syscall filtering (seccomp-bpf) in Linux for isolation, but requires elevated privileges to configure isolated launches, which it obtains through binding to the suid root flag utility or by using sudo. The vulnerability arises from a logic error in the '--join=' option, intended for connecting to an already running isolated environment (similar to the login command for sandbox environments) by defining the environment through the process ID of the running process. Before privilege drop, Firejail determines the privileges of the specified process and applies them to a new process being connected to the environment using the '--join' option.
Before connecting, it checks whether the specified process is running in the Firejail environment. This check evaluates the presence of the file /run/firejail/mnt/join. To exploit the vulnerability, an attacker can simulate a fake non-isolated Firejail environment using the mount namespace, and then connect to it using the '--join' option. If the settings do not enable the restriction of obtaining additional privileges in new processes (prctl NO_NEW_PRIVS), Firejail will connect the user to the fake environment and attempt to apply the user namespace settings of the init process (PID 1).
As a result, the process connected via 'firejail —join' will reside in the original user namespace with unchanged privileges, but within a different mount namespace that is entirely controlled by the attacker. This includes the ability for the attacker to execute setuid-root programs in the created mount namespace, which allows, for example, changing the settings in /etc/sudoers or PAM parameters within their file hierarchy and gaining the ability to run commands with root privileges using sudo or su utilities.
Source: opennet.ru
