Every CVE Search/ Get API key

CVE-2022-31214

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a...

7.8 HighFix available

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.40%Down 2.1 points since Jun 10, 2022
90%50%10%1%

What each source reports

NVD Score used 7.8

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.

Record
CVE-2022-31214
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-269
Updated
2026-11-02
CVE List No score

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.

Record
CVE-2022-31214
Updated
2026-11-02
EUVDEUVD-2022-52798 No score

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.

Record
EUVD-2022-52798
Updated
2026-11-03
GitHub AdvisoriesGHSA-m2xv-wgqg-4gxh 7.8

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a...

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.

Record
GHSA-m2xv-wgqg-4gxh
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-02
OSVDEBIAN-CVE-2022-31214 7.8

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.

Record
DEBIAN-CVE-2022-31214
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVUBUNTU-CVE-2022-31214 7.8

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.

Record
UBUNTU-CVE-2022-31214
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSV No score

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.

Record
CVE-2022-31214
Updated
2026-11-02
OSVMGASA-2022-0348 No score

Updated firejail packages fix security vulnerability

root escalation in --join logic (CVE-2022-31214)

Record
MGASA-2022-0348
Updated
2026-11-02
OSVopenSUSE-SU-2022:10015-1 No score

Security update for firejail

This update for firejail fixes the following issues:

firejail was updated to version 0.9.70:

-CVE-2022-31214: - root escalation in --join logic (boo#1199148) Reported by Matthias Gerstner, working exploit code was provided to our development team. In the same time frame, the problem was independently reported by Birk Blechschmidt. Full working exploit code was also provided.

  • feature: enable shell tab completion with --tab (#4936)
  • feature: disable user profiles at compile time (#4990)
  • feature: Allow resolution of .local names with avahi-daemon in the apparmor
  • profile (#5088)
  • feature: always log seccomp errors (#5110)
  • feature: firecfg --guide, guided user configuration (#5111)
  • feature: --oom, kernel OutOfMemory-killer (#5122)
  • modif: --ids feature needs to be enabled at compile time (#5155)
  • modif: --nettrace only available to root user
  • rework: whitelist restructuring (#4985)
  • rework: firemon, speed up and lots of fixes
  • bugfix: --private-cwd not expanding macros, broken hyperrogue (#4910)
  • bugfix: nogroups + wrc prints confusing messages (#4930 #4933)
  • bugfix: openSUSE Leap - whitelist-run-common.inc (#4954)
  • bugfix: fix printing in evince (#5011)
  • bugfix: gcov: fix gcov functions always declared as dummy (#5028)
  • bugfix: Stop warning on safe supplementary group clean (#5114)
  • build: remove ultimately unused INSTALL and RANLIB check macros (#5133)
  • build: mkdeb.sh.in: pass remaining arguments to ./configure (#5154)
  • ci: replace centos (EOL) with almalinux (#4912)
  • ci: fix --version not printing compile-time features (#5147)
  • ci: print version after install & fix apparmor support on build_apparmor (#5148)
  • docs: Refer to firejail.config in configuration files (#4916)
  • docs: firejail.config: add warning about allow-tray (#4946)
  • docs: mention that the protocol command accumulates (#5043)
  • docs: mention inconsistent homedir bug involving --private=dir (#5052)
  • docs: mention capabilities(7) on --caps (#5078)
  • new profiles: onionshare, onionshare-cli, opera-developer, songrec
  • new profiles: node-gyp, npx, semver, ping-hardened
  • removed profiles: nvm
Record
openSUSE-SU-2022:10015-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:10016-1 No score

Security update for firejail

This update for firejail fixes the following issues:

firejail was updated to version 0.9.70:

  • CVE-2022-31214 - root escalation in --join logic (boo#1199148)

    Reported by Matthias Gerstner, working exploit code was provided to our development team. In the same time frame, the problem was independently reported by Birk Blechschmidt. Full working exploit code was also provided.

  • feature: enable shell tab completion with --tab (#4936)

  • feature: disable user profiles at compile time (#4990)

  • feature: Allow resolution of .local names with avahi-daemon in the apparmor

  • profile (#5088)

  • feature: always log seccomp errors (#5110)

  • feature: firecfg --guide, guided user configuration (#5111)

  • feature: --oom, kernel OutOfMemory-killer (#5122)

  • modif: --ids feature needs to be enabled at compile time (#5155)

  • modif: --nettrace only available to root user

  • rework: whitelist restructuring (#4985)

  • rework: firemon, speed up and lots of fixes

  • bugfix: --private-cwd not expanding macros, broken hyperrogue (#4910)

  • bugfix: nogroups + wrc prints confusing messages (#4930 #4933)

  • bugfix: openSUSE Leap - whitelist-run-common.inc (#4954)

  • bugfix: fix printing in evince (#5011)

  • bugfix: gcov: fix gcov functions always declared as dummy (#5028)

  • bugfix: Stop warning on safe supplementary group clean (#5114)

  • build: remove ultimately unused INSTALL and RANLIB check macros (#5133)

  • build: mkdeb.sh.in: pass remaining arguments to ./configure (#5154)

  • ci: replace centos (EOL) with almalinux (#4912)

  • ci: fix --version not printing compile-time features (#5147)

  • ci: print version after install & fix apparmor support on build_apparmor (#5148)

  • docs: Refer to firejail.config in configuration files (#4916)

  • docs: firejail.config: add warning about allow-tray (#4946)

  • docs: mention that the protocol command accumulates (#5043)

  • docs: mention inconsistent homedir bug involving --private=dir (#5052)

  • docs: mention capabilities(7) on --caps (#5078)

  • new profiles: onionshare, onionshare-cli, opera-developer, songrec

  • new profiles: node-gyp, npx, semver, ping-hardened

  • removed profiles: nvm

update to firejail 0.9.68:

  • security: on Ubuntu, the PPA is now recommended over the distro package (see README.md) (#4748)
  • security: bugfix: private-cwd leaks access to the entire filesystem (#4780); reported by Hugo Osvaldo Barrera
  • feature: remove (some) environment variables with auth-tokens (#4157)
  • feature: ALLOW_TRAY condition (#4510 #4599)
  • feature: add basic Firejail support to AppArmor base abstraction (#3226 #4628)
  • feature: intrusion detection system (--ids-init, --ids-check)
  • feature: deterministic shutdown command (--deterministic-exit-code, --deterministic-shutdown) (#928 #3042 #4635)
  • feature: noprinters command (#4607 #4827)
  • feature: network monitor (--nettrace)
  • feature: network locker (--netlock) (#4848)
  • feature: whitelist-ro profile command (#4740)
  • feature: disable pipewire with --nosound (#4855)
  • feature: Unset TMP if it doesn't exist inside of sandbox (#4151)
  • feature: Allow apostrophe in whitelist and blacklist (#4614)
  • feature: AppImage support in --build command (#4878)
  • modifs: exit code: distinguish fatal signals by adding 128 (#4533)
  • modifs: firecfg.config is now installed to /etc/firejail/ (#408 #4669)
  • modifs: close file descriptors greater than 2 (--keep-fd) (#4845)
  • modifs: nogroups now stopped causing certain system groups to be dropped,
  • which are now controlled by the relevant 'no' options instead (such as
  • nosound -> drop audio group), which fixes device access issues on systems
  • not using (e)logind (such as with seatd) (#4632 #4725 #4732 #4851)
  • removal: --disable-whitelist at compile time
  • removal: whitelist=yes/no in /etc/firejail/firejail.config
  • bugfix: Fix sndio support (#4362 #4365)
  • bugfix: Error mounting tmpfs (MS_REMOUNT flag not being cleared) (#4387)
  • bugfix: --build clears the environment (#4460 #4467)
  • bugfix: firejail hangs…
Record
openSUSE-SU-2022:10016-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12136-1 No score

firejail-0.9.68-3.1 on GA media

These are all security issues fixed in the firejail-0.9.68-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12136-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firejail
Debian:12
 before 0.9.68-4
0.9.68-4
firejail
Debian:13
 before 0.9.68-4
0.9.68-4
firejail
Debian:14
 before 0.9.68-4
0.9.68-4
firejail
Debian:9
 before 0.9.58.2-2+deb9u1, plus listed versions
0.9.44.10-10.9.44.8-20.9.44.8-2+deb9u10.9.44.8-2+deb9u20.9.46-1
Show 29 moreShow less
0.9.46-20.9.46~rc1-10.9.48-10.9.48-20.9.50-10.9.50-20.9.50-30.9.50-3~bpo9+10.9.50~rc1-10.9.50~rc1-20.9.52-10.9.52-20.9.52-2~bpo9+10.9.52-2~bpo9+20.9.52-30.9.54-10.9.54-1~bpo9+10.9.54~rc1-10.9.54~rc2-10.9.56-10.9.56-20.9.56-2~bpo9+10.9.56~rc1-10.9.58-10.9.58.2-10.9.58.2-1~bpo9+10.9.58.2-20.9.58.2-2~bpo9+10.9.58~rc1-1
0.9.58.2-2+deb9u1
firejail
Debian:10
 before 0.9.58.2-2+deb10u3, plus listed versions
0.9.58.2-20.9.58.2-2+deb10u10.9.58.2-2+deb10u2
0.9.58.2-2+deb10u3
firejail
Debian:11
 before 0.9.64.4-2+deb11u1, plus listed versions
0.9.64.4-2
0.9.64.4-2+deb11u1
firejail
Mageia:8
 before 0.9.70-1.1.mga8
0.9.70-1.1.mga8
firejail
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.9.28-10.9.32-10.9.34-10.9.36-10.9.38-10.9.38-1ubuntu0.10.9.38.10-0ubuntu0.16.04.1
 None known
firejail
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.9.50-30.9.52-10.9.52-2
 None known
firejail
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.9.60-20.9.62-10.9.62-20.9.62-30.9.62-3ubuntu0.1
 None known
Show 9 moreShow less
Affected packages
PackageAffectedFixed
firejail
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.9.64.4-20.9.66-2
 None known
firejail
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.9.72-20.9.72-2ubuntu3
 None known
firejail
Ubuntu:25.10
 All versions, plus listed versions
0.9.72-2ubuntu3
 None known
firejail
Ubuntu:26.10
 All versions, plus listed versions
0.9.72-2ubuntu50.9.80-1
 None known
firejail
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.9.72-2ubuntu30.9.72-2ubuntu40.9.72-2ubuntu5
 None known
firejail
SUSE:Package Hub 15 SP3
 before 0.9.70-bp153.2.6.1
0.9.70-bp153.2.6.1
firejail
openSUSE:Leap 15.3
 before 0.9.70-bp153.2.6.1
0.9.70-bp153.2.6.1
firejail
SUSE:Package Hub 15 SP4
 before 0.9.70-bp154.2.3.1
0.9.70-bp154.2.3.1
firejail
openSUSE:Leap 15.4
 before 0.9.70-bp154.2.3.1
0.9.70-bp154.2.3.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31214 is a high vulnerability (CVSS 7.8) in Debian Linux, published June 9, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in firejail 0.9.68-4.

References

Show 19 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open