CVE-2022-31214: Firejail Privilege Escalation Vulnerability

CVE-2022-31214 Overview

A Privilege Context Switching vulnerability was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.

Critical Impact

Local attackers can achieve full root privilege escalation by exploiting the improper privilege context switching in Firejail's join functionality, potentially compromising the entire host system.

Affected Products

• Firejail Project Firejail 0.9.68
• Fedora 35, 36, 37
• Debian Linux 9.0 and 10.0

Discovery Timeline

• June 9, 2022 - CVE-2022-31214 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-31214

Vulnerability Analysis

This vulnerability resides in the join.c file within Firejail, a SUID sandbox program designed to isolate untrusted applications. The flaw stems from improper privilege context switching when processing join requests to existing Firejail sandboxes.

When a user attempts to join an existing Firejail sandbox, the setuid-root Firejail binary performs validation to ensure the target sandbox is legitimate. However, the vulnerability allows an attacker to craft a malicious container that passes these validation checks while maintaining critical privileges that should be dropped.

The attack exploits three key conditions that persist after joining the attacker-controlled sandbox:

1. The Linux user namespace remains the initial user namespace rather than an unprivileged one
2. The NO_NEW_PRIVS prctl flag is not activated, allowing privilege escalation through setuid binaries
3. The mount namespace is controlled by the attacker, enabling filesystem manipulation

This combination allows the attacker to adjust the filesystem layout and execute setuid-root binaries like su or sudo to escalate to full root privileges.

Root Cause

The root cause is improper privilege management (CWE-269) in the Firejail join functionality. The join.c component fails to properly validate that all security constraints are in place before allowing a user to join what appears to be a legitimate Firejail sandbox. The validation logic does not adequately verify that critical security properties such as user namespace isolation and NO_NEW_PRIVS status are correctly established, allowing an attacker-crafted container to bypass these security mechanisms.

Attack Vector

The attack requires local access to the system with the ability to execute the Firejail binary. An attacker crafts a fake Firejail container environment that mimics a legitimate sandbox but maintains the initial user namespace and lacks the NO_NEW_PRIVS restriction. When the Firejail setuid-root program joins this bogus container:

1. The attacker sets up a deceptive environment that passes Firejail's sandbox validation
2. Upon joining, the attacker gains access to a context where namespace isolation is not enforced
3. The attacker manipulates the mount namespace to control filesystem paths
4. By executing setuid-root binaries such as su or sudo in this manipulated environment, the attacker escalates privileges to root

The attack leverages the trust placed in the Firejail setuid-root binary to transition into what should be a secure context but is actually attacker-controlled.

Detection Methods for CVE-2022-31214

Indicators of Compromise

• Unusual Firejail join operations targeting non-standard or recently created sandbox environments
• Unexpected privilege escalation events following Firejail execution
• Suspicious modifications to mount namespaces or filesystem layouts near setuid binaries
• Anomalous su or sudo execution patterns originating from Firejail contexts

Detection Strategies

• Monitor process trees for Firejail execution followed by unexpected root privilege acquisition
• Implement audit rules on setuid-root binaries (su, sudo) to detect execution from unusual namespace contexts
• Track mount namespace changes and correlate with Firejail process activity
• Alert on Firejail join operations targeting sandbox IDs that don't match known legitimate sandboxes

Monitoring Recommendations

• Enable detailed auditd logging for Firejail binary execution and subsequent process spawning
• Deploy endpoint detection to monitor for privilege escalation patterns associated with sandbox escape
• Implement file integrity monitoring on critical system binaries and Firejail configuration
• Review system logs for failed or anomalous sandbox join attempts that may indicate exploitation attempts

How to Mitigate CVE-2022-31214

Immediate Actions Required

• Update Firejail to a patched version as specified in vendor advisories immediately
• Temporarily disable Firejail join functionality if updates cannot be applied promptly
• Audit systems for signs of previous exploitation including unexpected root access events
• Restrict access to the Firejail binary to trusted users only as an interim measure

Patch Information

Security patches have been released by the Firejail Project and major Linux distributions. Consult the Firejail Release Notes for the official fix. Distribution-specific patches are available through:

• Debian Security Advisory DSA-5167
• Debian LTS Announcement
• Fedora Package Announcements
• Gentoo GLSA 2023-05-19

Workarounds

• Remove the setuid bit from the Firejail binary if the join functionality is not required: chmod u-s /usr/bin/firejail
• Disable the join feature by configuring Firejail with restricted options until patching is complete
• Implement mandatory access control policies (SELinux/AppArmor) to restrict Firejail privilege transitions
• Limit user access to Firejail through group-based permissions to reduce the attack surface

# Temporary workaround: Remove setuid bit from Firejail
sudo chmod u-s /usr/bin/firejail

# Verify the permission change
ls -la /usr/bin/firejail

# Note: This disables sandboxing functionality requiring root privileges
# Apply official patches and restore setuid when available