Source: golang-gvisor-gvisor Version: 0.0~20240729.0-7 X-Debbugs-CC: [email protected] Severity: grave Tags: security upstream
Hi, The following vulnerability was published for golang-gvisor-gvisor. i'm not completely sure if this affects our old version, but still filling it as RC level. Side question: it is still sensible to keep gvisor in Debian at this old version, should it be updated or removed? CVE-2026-96812[0]: | Improper Exposure of Resource to Wrong Sphere in the host file | helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on | Linux platforms with CUSE enabled allows a local attacker with | container image deployment privileges to achieve root code execution | on the host system. By including a /dev/cuse character device node | in a container image, opening the device passes through to the host, | allowing the sandboxed attacker to register a host device and | exploit CUSE unrestricted ioctl handling to overwrite root udev | helper memory. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-96812 https://www.cve.org/CVERecord?id=CVE-2026-96812 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
