Every CVE Search/ Get API key

CVE-2020-5291

Privilege escalation in setuid mode via user namespaces in Bubblewrap

7.2 HighFix available

Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the bwrap --userns2 option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using linux-hardened, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.90%Up 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.2

Privilege escalation in setuid mode via user namespaces in Bubblewrap

Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the bwrap --userns2 option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using linux-hardened, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.

Record
CVE-2020-5291
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-648
Updated
2026-11-02
EUVDEUVD-2020-26485 7.2

Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the bwrap --userns2 option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using linux-hardened, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.

Record
EUVD-2020-26485
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-03
NVD 7.2

Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the bwrap --userns2 option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using linux-hardened, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.

Record
CVE-2020-5291
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
8.5 HighAV:N/AC:M/Au:S/C:C/I:C/A:C
Weakness
CWE-648, CWE-269
Updated
2026-11-02
OSVALPINE-CVE-2020-5291 7.8

Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the bwrap --userns2 option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using linux-hardened, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.

Record
ALPINE-CVE-2020-5291
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2020-5291 7.8

CVE-2020-5291 does not affect BellSoft software

Record
BELL-CVE-2020-5291
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.8

Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the bwrap --userns2 option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using linux-hardened, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.

Record
CVE-2020-5291
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-5291 7.8

Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the bwrap --userns2 option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using linux-hardened, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.

Record
DEBIAN-CVE-2020-5291
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-5291 7.8

Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the bwrap --userns2 option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using linux-hardened, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.

Record
UBUNTU-CVE-2020-5291
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2024:10663-1 No score

bubblewrap-0.5.0-1.1 on GA media

These are all security issues fixed in the bubblewrap-0.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10663-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bubblewrap
Alpine:v3.11
 before 0.4.1-r0
0.4.1-r0
bubblewrap
Alpine:v3.12
 before 0.4.1-r0
0.4.1-r0
bubblewrap
Alpine:v3.13
 before 0.4.1-r0
0.4.1-r0
bubblewrap
Alpine:v3.14
 before 0.4.1-r0
0.4.1-r0
bubblewrap
Alpine:v3.15
 before 0.4.1-r0
0.4.1-r0
bubblewrap
Alpine:v3.16
 before 0.4.1-r0
0.4.1-r0
bubblewrap
Alpine:v3.17
 before 0.4.1-r0
0.4.1-r0
bubblewrap
Alpine:v3.18
 before 0.4.1-r0
0.4.1-r0
bubblewrap
Alpine:v3.19
 before 0.4.1-r0
0.4.1-r0
bubblewrap
Alpine:v3.20
 before 0.4.1-r0
0.4.1-r0
Show 9 moreShow less
Affected packages
PackageAffectedFixed
bubblewrap
Alpine:v3.21
 before 0.4.1-r0
0.4.1-r0
bubblewrap
Alpine:v3.22
 before 0.4.1-r0
0.4.1-r0
bubblewrap
Alpine:v3.23
 before 0.4.1-r0
0.4.1-r0
bubblewrap
Alpine:v3.24
 before 0.4.1-r0
0.4.1-r0
bubblewrap
Debian:12
 before 0.4.1-1
0.4.1-1
bubblewrap
Debian:13
 before 0.4.1-1
0.4.1-1
bubblewrap
Debian:14
 before 0.4.1-1
0.4.1-1
bubblewrap
Ubuntu:20.04:LTS
 before 0.4.0-1ubuntu4, plus listed versions
0.3.3-20.4.0-10.4.0-1ubuntu10.4.0-1ubuntu20.4.0-1ubuntu3
0.4.0-1ubuntu4
bubblewrap
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 0.5.0-1.1
0.5.0-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-5291 is a high vulnerability (CVSS 7.2) in Centos, published March 31, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 60th percentile. Fixed in bubblewrap 0.4.1-r0.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open