Skip to content
Fencer Vulns
high 7.2

CVE-2020-5291 json

Privilege escalation in setuid mode via user namespaces in Bubblewrap

published 2020-03-31 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-26485

cvss
7.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits
0
none known

Summary

Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using `linux-hardened`, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.

Patch / fix

  • projectatomic bubblewrap 0.4.1
  • bubblewrap Debian 14, Debian 13, Debian 12 0.4.1-1

debian advisories DEBIAN-CVE-2020-5291

  • bubblewrap Ubuntu 20.04 LTS 0.4.0-1ubuntu4

ubuntu advisories UBUNTU-CVE-2020-5291

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bubblewrap openSUSE Tumbleweed 0.5.0-1.1

opensuse advisories openSUSE-SU-2024:10663-1

  • bubblewrap Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 0.4.1-r0

alpine advisories ALPINE-CVE-2020-5291

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-5291 updated cvss 7.2

bubblewrap: privilege escalation in some kernel configurations

  • Red Hat CloudForms Management Engine 5 bubblewrap Red Hat Ansible Tower 3 bubblewrap Red Hat Enterprise Linux 8 bubblewrap
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.90% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C

Affected products

  • containers bubblewrap

Classification

Weakness
  • CWE-648 Incorrect Use of Privileged APIs
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.