[GH-ISSUE #5747] CVE-2023-28100 and firejail #3081

New issue

Closed

opened 2026-05-05 09:43:17 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:43:17 -06:00

Owner

Originally created by @rusty-snake on GitHub (Mar 22, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5747

Are we affected by it in some way too?

https://github.com/flatpak/flatpak/security/advisories/GHSA-7qpw-3vjv-xrqp

cc @netblue30 @smitsohu @topimiettinen

Originally created by @rusty-snake on GitHub (Mar 22, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/5747 Are we affected by it in some way too? https://github.com/flatpak/flatpak/security/advisories/GHSA-7qpw-3vjv-xrqp cc @netblue30 @smitsohu @topimiettinen

gitea-mirror

2026-05-05 09:43:17 -06:00

closed this issue
added the
security
label

gitea-mirror commented

2026-05-05 09:43:20 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 23, 2023):

We flush the terminal input upon sandbox exit, it is possible we are fine.

https://github.com/netblue30/firejail/blob/master/src/firejail/util.c#L962

I'll have to do some digging, the exploit looks very similar to the original one from 2016.

@netblue30 commented on GitHub (Mar 23, 2023): We flush the terminal input upon sandbox exit, it is possible we are fine. https://github.com/netblue30/firejail/blob/master/src/firejail/util.c#L962 I'll have to do some digging, the exploit looks very similar to the original one from 2016.

gitea-mirror commented

2026-05-05 09:43:21 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 23, 2023):

We are fine!

$ firejail ./a.out
head -n /etc/passwd
head -n /etc/passwd
Warning: removing 21 bytes from stdin

Parent is shutting down, bye...
$

@netblue30 commented on GitHub (Mar 23, 2023): We are fine! ````` $ firejail ./a.out head -n /etc/passwd head -n /etc/passwd Warning: removing 21 bytes from stdin Parent is shutting down, bye... $ `````

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3081

No description provided.

Rows
Columns