CVE-2020-5291 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-5291 Interim 1 23 2026-03-05T05:57:23Z current 2021-05-30T14:36:08Z 2026-03-05T05:57:23Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-5291 Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using `linux-hardened`, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Desktop Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 openSUSE Leap 15.2 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Tumbleweed bubblewrap bubblewrap-0.11.0-150500.3.9.1 bubblewrap-0.11.0-160000.2.2 bubblewrap-0.4.1-1.16 bubblewrap-0.4.1-lp152.1.3 bubblewrap-0.5.0-1.1 bubblewrap-0.7.0-150500.1.1 bubblewrap-0.8.0-150500.3.3.1 bubblewrap-zsh-completion-0.11.0-150500.3.9.1 bubblewrap-zsh-completion-0.11.0-160000.2.2 bubblewrap-zsh-completion-0.5.0-1.1 bubblewrap-zsh-completion-0.7.0-150500.1.1 bubblewrap-zsh-completion-0.8.0-150500.3.3.1 bubblewrap-0.4.1-1.16 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 bubblewrap-0.4.1-1.16 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 bubblewrap-0.4.1-1.16 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 bubblewrap-0.7.0-150500.1.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 bubblewrap-zsh-completion-0.7.0-150500.1.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 bubblewrap-0.8.0-150500.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 bubblewrap-zsh-completion-0.8.0-150500.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 bubblewrap-0.11.0-150500.3.9.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 bubblewrap-zsh-completion-0.11.0-150500.3.9.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 bubblewrap-0.11.0-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 bubblewrap-zsh-completion-0.11.0-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 bubblewrap-0.4.1-lp152.1.3 as a component of openSUSE Leap 15.2 bubblewrap-0.4.1-1.16 as a component of openSUSE Leap 15.3 bubblewrap-0.4.1-1.16 as a component of openSUSE Leap 15.4 bubblewrap-0.5.0-1.1 as a component of openSUSE Tumbleweed bubblewrap-zsh-completion-0.5.0-1.1 as a component of openSUSE Tumbleweed bubblewrap as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 bubblewrap as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using `linux-hardened`, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update. CVE-2020-5291 SUSE Linux Enterprise Module for Basesystem 15 SP2:bubblewrap-0.4.1-1.16 SUSE Linux Enterprise Module for Basesystem 15 SP3:bubblewrap-0.4.1-1.16 SUSE Linux Enterprise Module for Basesystem 15 SP4:bubblewrap-0.4.1-1.16 SUSE Linux Enterprise Module for Basesystem 15 SP5:bubblewrap-0.7.0-150500.1.1 SUSE Linux Enterprise Module for Basesystem 15 SP5:bubblewrap-zsh-completion-0.7.0-150500.1.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:bubblewrap-0.8.0-150500.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:bubblewrap-zsh-completion-0.8.0-150500.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:bubblewrap-0.11.0-150500.3.9.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:bubblewrap-zsh-completion-0.11.0-150500.3.9.1 SUSE Linux Enterprise Server 16.0:bubblewrap-0.11.0-160000.2.2 SUSE Linux Enterprise Server 16.0:bubblewrap-zsh-completion-0.11.0-160000.2.2 openSUSE Leap 15.2:bubblewrap-0.4.1-lp152.1.3 openSUSE Leap 15.3:bubblewrap-0.4.1-1.16 openSUSE Leap 15.4:bubblewrap-0.4.1-1.16 openSUSE Tumbleweed:bubblewrap-0.5.0-1.1 openSUSE Tumbleweed:bubblewrap-zsh-completion-0.5.0-1.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:bubblewrap SUSE Linux Enterprise Module for Desktop Applications 15 SP1:bubblewrap important 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H