CVE-2021-26910: debian debian_linux
CVSS: 7.8v3.1HighModified
AliasesMGASA-2021-0120UBUNTU-CVE-2021-26910USN-5141-1DEBIAN-CVE-2021-26910DLA-2554-1DSA-4849-1
Published 08-02-2021Last modified 03-08-2024
Vulnerability summary
CVE-2021-26910 is a high (CVSS 7.8) vulnerability in debian debian_linux. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.5% of scored vulnerabilities. 3 public exploits are recorded.
CVSS score
7.8/10
010
High · v3.1 (CVE.org)EPSS score
0.44%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3reference
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 08-02-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 7.8Preferred score · CVE.org (CNA)
CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:NSources4 sources · 7.0–7.8
- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
Medium 6.9Preferred score · NVD (NIST)
AV:L/AC:M/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
0.00 pp
From 0.44% on 21-09-2026
21-09-202621-10-2026
EPSS score0.44%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (unparalleled.eu)
Maturity: unknown
Exploit Reference (unparalleled.eu)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- firejail< 0.9.58.2-2+deb10u2 | < 0.9.44.8-2+deb9u2 | < 0.9.64.4-1
- debian_linuxEOL9.0 | 10.0
Mageia2 products
- firejail< 0.9.56-2.3.mga7
- firejail< 0.9.64-1.1.mga8
Firejail_project1 product
- firejail< 0.9.64.4
Ubuntu1 product
- firejailAll versions (No fix recorded) | < 0.9.62-3ubuntu0.1
4 vendors · 6 products
References
15 links- github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834bX Refsource MISCREPORTPatchThird Party Advisory
- unparalleled.eu/publications/2021/advisory-unpar-2021-0.txtX Refsource MISCREPORTExploitThird Party Advisory
- unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/X Refsource MISCREPORTExploitThird Party Advisory
- github.com/netblue30/firejail/releases/tag/0.9.64.4X Refsource MISCREPORTRelease NotesThird Party Advisory
- www.openwall.com/lists/oss-security/2021/02/09/1Mailing ListX Refsource MLISTREPORTExploitPatchThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/02/msg00015.htmlMailing ListX Refsource MLISTThird Party Advisory