CVE-2020-13753: canonical ubuntu_linux Improper Input Validation
Vulnerability summary
CVE-2020-13753 is a critical (CVSS 10.0) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 3.27% chance of exploitation in the next 30 days, higher than 88.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 15 · Related 12Timeline
- 14-07-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
3.27%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
0.00 pp
From 3.27% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu4 products
- qtwebkit-opensource-srcAll versions (No fix recorded)
- qtwebkit-sourceAll versions (No fix recorded)
- webkit2gtkAll versions (No fix recorded) | < 2.28.3-0ubuntu0.18.04.1 | < 2.28.3-0ubuntu0.20.04.1
- webkitgtkAll versions (No fix recorded)
Debian3 products
- webkit2gtk< 2.28.3-1
- wpewebkit< 2.28.3-1
- debian_linuxEOL10.0
Canonical1 product
- ubuntu_linuxEOL18.04 | 19.10 | 20.04
Fedoraproject1 product
- fedoraEOL31
Opensuse1 product
- leapEOL15.1
Webkitgtk1 product
- webkitgtk< 2.28.3
Wpewebkit1 product
- wpe_webkit< 2.28.3
7 vendors · 12 products
References
12 links
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00074.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory