Bug 916378 (CVE-2023-5557)

Summary:	<app-misc/tracker-miners-3.5.3: Sandbox weakness
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	normal	CC:	gnome
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=915500 https://bugs.gentoo.org/show_bug.cgi?id=933164
Whiteboard:	A3 [glsa?]
Package list:		Runtime testing required:	---
Bug Depends on:	916076
Bug Blocks:

Description Sam James archtester

2023-10-28 04:01:53 UTC

The sandbox before 3.5.3 was weak and allowed bug 915500 to become a 1-click RCE.

Comment 1 Sam James archtester

2023-10-30 10:54:54 UTC

As usual with seccomp, a bunch of issues have cropped up with the fix here:
* https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/280
* https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/281
* https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/283
* https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/284
* https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/288
* https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/287
* https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/285
* https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/289