Description (CNA)
Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Google / gVisor | affected 0 before 573a9e73cf844f |
CWE
CWE-668, CWE-269
References
ADP enrichment
No English description supplied.
No references supplied.