vendor:
by:
6.4
CVSS
MEDIUM
Bypass
284
CWE
Product Name:
Affected Version From:
Affected Version To:
Patch Exists: YES
Related CWE:
CPE:
Platforms Tested: Android
Seccomp Sandbox Bypass via ptrace
The seccomp sandbox in older kernels (before 4.8) does not run the seccomp check again after the tracer is notified. This allows ptrace to be used to escape from the seccomp sandbox. This vulnerability affects multiple Android devices with older kernels, making seccomp policies that don't blacklist ptrace ineffective as security boundaries.
Mitigation:
To mitigate this vulnerability, it is recommended to update the kernel to version 4.8 or newer. Additionally, seccomp policies should be updated to blacklist ptrace to prevent its use for sandbox escapes.