{"id":"CVE-2021-26910","aliases":["ALPINE-CVE-2021-26910","DEBIAN-CVE-2021-26910","DLA-2554-1","DSA-4849-1","EUVD-2021-13694","GHSA-2q4h-h5jp-942w","MGASA-2021-0120","UBUNTU-CVE-2021-26910","USN-5141-1","openSUSE-SU-2021:0271-1"],"status":"published","title":"Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is...","description":"Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0045,"percentile":0.39571,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2021-02-08T19:56:38Z","modified":"2026-11-03T06:32:32Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"firejail","fixed_in":["0.9.64.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"firejail","fixed_in":["0.9.64.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"firejail","fixed_in":["0.9.64.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"firejail","fixed_in":["0.9.64.4-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"firejail","fixed_in":["0.9.44.8-2+deb9u2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"firejail","fixed_in":["0.9.58.2-2+deb10u2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"firejail","fixed_in":["0.9.56-2.3.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"firejail","fixed_in":["0.9.64-1.1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"firejail","fixed_in":["0.9.62-3ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"firejail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.64.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"firejail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.64.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"firejail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.64.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"firejail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.64.4-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"firejail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.44.8-2+deb9u2"}]}],"versions":["0.9.44.8-2","0.9.44.8-2+deb9u1"]},{"source":"osv","ecosystem":"Debian:10","package":"firejail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.58.2-2+deb10u2"}]}],"versions":["0.9.58.2-2","0.9.58.2-2+deb10u1"]},{"source":"osv","ecosystem":"Mageia:7","package":"firejail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.56-2.3.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"firejail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.64-1.1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"firejail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.28-1","0.9.32-1","0.9.34-1","0.9.36-1","0.9.38-1","0.9.38-1ubuntu0.1","0.9.38.10-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"firejail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.50-3","0.9.52-1","0.9.52-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"firejail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.62-3ubuntu0.1"}]}],"versions":["0.9.60-2","0.9.62-1","0.9.62-2","0.9.62-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"firejail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.62-3ubuntu0.1"}]}],"versions":["0.9.60-2","0.9.62-1","0.9.62-2","0.9.62-3"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"firejail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.64.4-lp152.3.6.1"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"firejail_project","product":"firejail"}],"references":[{"url":"https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://github.com/netblue30/firejail/releases/tag/0.9.64.4","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2021/02/09/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"https://www.debian.org/security/2021/dsa-4849","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/02/msg00015.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202105-19","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26910"},{"url":"https://github.com/advisories/GHSA-2q4h-h5jp-942w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-26910","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-26910","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0120.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-26910","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/02/08/5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5141-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26910","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JJKSV64EI6OP7AKHJQVLFPJPOUXRN47F/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181990","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26910","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-26910","description":"Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.","status":"published","published":"2021-02-08T19:56:38Z","modified":"2024-08-03T20:33:41.306Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:32:57.033395Z"}],"euvd":[{"id":"EUVD-2021-13694","description":"Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.","status":"published","published":"2021-02-08T19:56:38Z","modified":"2024-08-03T20:33:41Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N","level":"high"}],"updated_at":"2026-11-03T03:24:50.84326Z"}],"ghsa":[{"id":"GHSA-2q4h-h5jp-942w","title":"Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is...","description":"Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.","status":"published","published":"2022-05-24T17:41:21Z","modified":"2023-01-29T05:05:37Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:45:50.403728Z"}],"nvd":[{"id":"CVE-2021-26910","description":"Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.","status":"published","published":"2021-02-08T20:15:13.09Z","modified":"2026-06-17T03:43:59.1Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:06:49.660551Z"}],"osv":[{"id":"ALPINE-CVE-2021-26910","description":"Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.","status":"published","published":"2021-02-08T20:15:13.09Z","modified":"2026-11-03T06:32:32.150158517Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2021-26910","description":"Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.","status":"published","published":"2021-02-08T20:15:13.09Z","modified":"2026-10-20T10:54:34.719462336Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-26910","description":"Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.","status":"published","published":"2021-02-08T20:15:13.09Z","modified":"2026-10-30T06:00:04.964427769Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"UBUNTU-CVE-2021-26910","description":"Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.","status":"published","published":"2021-02-08T20:15:00Z","modified":"2026-02-04T03:58:25.233107Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DLA-2554-1","title":"firejail - security update","status":"published","published":"2021-02-11T00:00:00Z","modified":"2026-03-09T01:19:48.586559Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4849-1","title":"firejail - security update","status":"published","published":"2021-02-09T00:00:00Z","modified":"2026-03-09T02:10:57.160286Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0120","title":"Updated firejail package fixes a security vulnerability","description":"Roman Fiedler discovered a vulnerability in the OverlayFS code in firejail,\nwhich could result in root privilege escalation. This update disables\nOverlayFS support in firejail (CVE-2021-26910).\n","status":"published","published":"2021-03-12T01:25:47Z","modified":"2026-04-16T04:41:37.768462106Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0271-1","title":"Security update for firejail","description":"This update for firejail fixes the following issues:\n\nfirejail 0.9.64.4 is shipped to openSUSE Leap 15.2\n\n- CVE-2021-26910: Fixed root privilege escalation due to race condition (boo#1181990)\n\nUpdate to 0.9.64.4:\n\n* disabled overlayfs, pending multiple fixes\n* fixed launch firefox for open url in telegram-desktop.profile\n\nUpdate to 0.9.64.2:\n\n* allow --tmpfs inside $HOME for unprivileged users\n* --disable-usertmpfs compile time option\n* allow AF_BLUETOOTH via --protocol=bluetooth\n* setup guide for new users: contrib/firejail-welcome.sh\n* implement netns in profiles\n* added nolocal6.net IPv6 network filter\n* new profiles: spectacle, chromium-browser-privacy,\n  gtk-straw-viewer, gtk-youtube-viewer, gtk2-youtube-viewer,\n  gtk3-youtube-viewer, straw-viewer, lutris, dolphin-emu,\n  authenticator-rs, servo, npm, marker, yarn, lsar, unar, agetpkg,\n  mdr, shotwell, qnapi, new profiles: guvcview, pkglog, kdiff3, CoyIM.\n\nUpdate to version 0.9.64:\n\n* replaced --nowrap option with --wrap in firemon\n* The blocking action of seccomp filters has been changed from\n  killing the process to returning EPERM to the caller. To get the\n  previous behaviour, use --seccomp-error-action=kill or\n  syscall:kill syntax when constructing filters, or override in\n  /etc/firejail/firejail.config file.\n* Fine-grained D-Bus sandboxing with xdg-dbus-proxy.\n  xdg-dbus-proxy must be installed, if not D-Bus access will be allowed.\n  With this version nodbus is deprecated, in favor of dbus-user none and\n  dbus-system none and will be removed in a future version.\n* DHCP client support\n* firecfg only fix dektop-files if started with sudo\n* SELinux labeling support\n* custom 32-bit seccomp filter support\n* restrict ${RUNUSER} in several profiles\n* blacklist shells such as bash in several profiles\n* whitelist globbing\n* mkdir and mkfile support for /run/user directory\n* support ignore for include\n* --include on the command line\n* splitting up media players whitelists in whitelist-players.inc\n* new condition: HAS_NOSOUND\n* new profiles: gfeeds, firefox-x11, tvbrowser, rtv, clipgrab, muraster\n* new profiles: gnome-passwordsafe, bibtex, gummi, latex, mupdf-x11-curl\n* new profiles: pdflatex, tex, wpp, wpspdf, wps, et, multimc, mupdf-x11\n* new profiles: gnome-hexgl, com.github.johnfactotum.Foliate, mupdf-gl, mutool\n* new profiles: desktopeditors, impressive, planmaker18, planmaker18free\n* new profiles: presentations18, presentations18free, textmaker18, teams\n* new profiles: textmaker18free, xournal, gnome-screenshot, ripperX\n* new profiles: sound-juicer, com.github.dahenson.agenda, gnome-pomodoro\n* new profiles: gnome-todo, x2goclient, iagno, kmplayer, penguin-command\n* new profiles: frogatto, gnome-mines, gnome-nibbles, lightsoff, warmux\n* new profiles: ts3client_runscript.sh, ferdi, abiword, four-in-a-row\n* new profiles: gnome-mahjongg, gnome-robots, gnome-sudoku, gnome-taquin\n* new profiles: gnome-tetravex, blobwars, gravity-beams-and-evaporating-stars\n* new profiles: hyperrogue, jumpnbump-menu, jumpnbump, magicor, mindless\n* new profiles: mirrormagic, mrrescue, scorched3d-wrapper, scorchwentbonkers\n* new profiles: seahorse-adventures, wordwarvi, xbill, gnome-klotski\n* new profiles: swell-foop, fdns, five-or-more, steam-runtime\n* new profiles: nicotine, plv, mocp, apostrophe, quadrapassel, dino-im\n* new profiles: hitori, bijiben, gnote, gnubik, ZeGrapher, xonotic-sdl-wrapper\n* new profiles: gapplication, openarena_ded, element-desktop, cawbird\n* new profiles: freetube, strawberry, jitsi-meet-desktop\n* new profiles: homebank, mattermost-desktop, newsflash, com.gitlab.newsflash\n* new profiles: sushi, xfce4-screenshooter, org.gnome.NautilusPreviewer, lyx\n* new profiles: minitube, nuclear, mtpaint, minecraft-launcher, gnome-calendar\n* new profiles: vmware, git-cola, otter-browser, kazam, menulibre, musictube\n* new profiles: onboard, fractal, mirage, quaternion, spectral, man, psi\n* new profiles: smuxi-frontend-gnome, balsa, kube, trojita, youtube\n* new profiles: youtubemusic-nativefier, cola, dbus-send, notify-send\n* new profiles: qrencode, ytmdesktop, twitch\n* new profiles: xournalpp, chromium-freeworld, equalx\n\n- Make the AppArmor profile compatible with AppArmor 3.0 (add missing include \u003ctunables/global\u003e)\n\nUpdate to 0.9.62.4\n\n* fix AppArmor broken in the previous release\n* miscellaneous fixes\n\nUpdate to 0.9.62.2\n\n* fix CVE-2020-17367\n* fix CVE-2020-17368\n","status":"published","published":"2021-02-10T17:03:36Z","modified":"2026-02-04T04:07:11.239317Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"USN-5141-1","title":"firejail vulnerability","description":"Roman Fiedler discovered that a race condition existed in Firejail\nwhen using OverlayFS to prevent writes to the underlying file system. A\nlocal attacker could use this to gain administrative privileges. Note:\nthis update disables support for OverlayFS in Firejail.\n","status":"published","published":"2021-11-11T07:52:38Z","modified":"2026-04-27T16:11:50.431516Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}