tinfoil-factory/netfoil · Security
netfoil's optional seccomp sandboxing was not applied
- GHSA ID
- GHSA-vjgj-42f6-7997
- Severity
- medium
- Published
- Updated
- CVSS v4
- 6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Description
Summary
The optional flag --filter-system-calls was not applied even if specified.
Details
This is a defense in depth feature to apply additional seccomp filters after the binary has started. The example config also sandboxes the binary with systemd.
Impact
Reduced sandboxing of the netfoil binary.
CWEs
- CWE-791 · Incomplete Filtering of Special Elements