VulnSocial

CVE-2022-31214Disclosure(debian / debian_linux)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch debian debian_linux systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.

debian CVEsBack to dashboard
1.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • debian_linux
  • fedora
  • firejail

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
debianfedoraprojectfirejail_project
Products
debian_linuxfedorafirejail

6 versions affected across 3 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-07-20: 1Patch / Workaround · 2026-07-20: 1Technical Details · 2026-07-20: 107-20
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • botmonster@botmonster
    Disclosure

    CVE-2022-31214 broke Firejail's SUID binary out to full root. Both add only ~5ms overhead, far lighter than Docker. Wrap npm install so a bad post-install never sees ~/.ssh. https://botmonster.com/self-hosting/sandbox-linux-apps-cli-tools-bubblewrap/?utm_source=twitter&utm_medium=social #SelfHosted

    Post summary

    The tweet announces that CVE‑2022‑31214 allows an attacker to gain full root through Firejail's SUID binary and offers a workaround by wrapping npm install to mitigate the risk to SSH credentials.

    0000021
    35 followersView on X
CPE platform detail6 entries

6 of 6 entries

PartVendorProductVersionTarget SWTarget HW
OSdebiandebian_linux10.0--
OSdebiandebian_linux9.0--
OSfedoraprojectfedora35--
OSfedoraprojectfedora36--
OSfedoraprojectfedora37--
Appfirejail_projectfirejail0.9.68--

Explore more

Back to dashboarddebian CVEsfedoraproject CVEsfirejail_project CVEsdebian_linux vulnerabilities