birdcage

Version	Released
`0.8.1` unknown	Apr 19, 2024
`0.8.0` unknown	Apr 19, 2024
`0.7.1` unknown	Feb 07, 2024
`0.7.0` unknown	Dec 01, 2023
`0.6.0` unknown 1 CVE	Nov 16, 2023
`0.5.0` unknown 1 CVE	Oct 17, 2023
`0.4.0` unknown yanked 1 CVE	Oct 10, 2023
`0.3.1` unknown 1 CVE	Aug 31, 2023
`0.3.0` unknown 1 CVE	Aug 31, 2023
`0.2.2` unknown 1 CVE	Aug 29, 2023
`0.2.1` unknown yanked 1 CVE	Mar 29, 2023
`0.2.0` unknown yanked 1 CVE	Feb 07, 2023
`0.1.0` unknown 1 CVE	Oct 19, 2022

0.8.1 unknown

Apr 19, 2024

0.8.0 unknown

Apr 19, 2024

0.7.1 unknown

Feb 07, 2024

0.7.0 unknown

Dec 01, 2023

0.6.0 unknown

1 CVE

GHSA-wj7f-468m-6mv8 Dec 01, 2023

Environment variables still accessible through /proc

4.0 / 10

Medium

Local Low None None Unchanged Low None None

Impact

Environment variables can be read from procfs unless a new process is started.

PoC

use birdcage::{Birdcage, Sandbox};
use std::{env, fs};

fn main() {
    Birdcage::new().lock().unwrap();

    assert_eq!(env::var_os("SECRET"), None);

    let environ = fs::read_to_string("/proc/self/environ").unwrap();
    assert!(!environ.contains("SECRET"), "ENVIRON CONTAINS SECRET:\n{environ}");
}

$  SECRET=test cargo run
thread 'main' panicked at src/main.rs:10:5:
ENVIRON CONTAINS SECRET:
 [truncated]

Possible Solutions

The simplest solution would be relying on the ptrace isolation and always spawning a new process by changing birdcage's API to create a new command. With an additional PID namespace the guarantees could be even further reinforced.

Fixed in


          0.7.0

References

Updated Dec 01, 2023 · Source: OSV.dev

Nov 16, 2023

0.5.0 unknown

1 CVE

GHSA-wj7f-468m-6mv8 Dec 01, 2023

Environment variables still accessible through /proc

4.0 / 10

Medium

Local Low None None Unchanged Low None None

Impact

Environment variables can be read from procfs unless a new process is started.

PoC

use birdcage::{Birdcage, Sandbox};
use std::{env, fs};

fn main() {
    Birdcage::new().lock().unwrap();

    assert_eq!(env::var_os("SECRET"), None);

    let environ = fs::read_to_string("/proc/self/environ").unwrap();
    assert!(!environ.contains("SECRET"), "ENVIRON CONTAINS SECRET:\n{environ}");
}

$  SECRET=test cargo run
thread 'main' panicked at src/main.rs:10:5:
ENVIRON CONTAINS SECRET:
 [truncated]

Possible Solutions

The simplest solution would be relying on the ptrace isolation and always spawning a new process by changing birdcage's API to create a new command. With an additional PID namespace the guarantees could be even further reinforced.

Fixed in


          0.7.0

References

Updated Dec 01, 2023 · Source: OSV.dev

Oct 17, 2023

0.4.0 unknown yanked

1 CVE

GHSA-wj7f-468m-6mv8 Dec 01, 2023

Environment variables still accessible through /proc

4.0 / 10

Medium

Local Low None None Unchanged Low None None

Impact

Environment variables can be read from procfs unless a new process is started.

PoC

use birdcage::{Birdcage, Sandbox};
use std::{env, fs};

fn main() {
    Birdcage::new().lock().unwrap();

    assert_eq!(env::var_os("SECRET"), None);

    let environ = fs::read_to_string("/proc/self/environ").unwrap();
    assert!(!environ.contains("SECRET"), "ENVIRON CONTAINS SECRET:\n{environ}");
}

$  SECRET=test cargo run
thread 'main' panicked at src/main.rs:10:5:
ENVIRON CONTAINS SECRET:
 [truncated]

Possible Solutions

The simplest solution would be relying on the ptrace isolation and always spawning a new process by changing birdcage's API to create a new command. With an additional PID namespace the guarantees could be even further reinforced.

Fixed in


          0.7.0

References

Updated Dec 01, 2023 · Source: OSV.dev

Oct 10, 2023

0.3.1 unknown

1 CVE

GHSA-wj7f-468m-6mv8 Dec 01, 2023

Environment variables still accessible through /proc

4.0 / 10

Medium

Local Low None None Unchanged Low None None

Impact

Environment variables can be read from procfs unless a new process is started.

PoC

use birdcage::{Birdcage, Sandbox};
use std::{env, fs};

fn main() {
    Birdcage::new().lock().unwrap();

    assert_eq!(env::var_os("SECRET"), None);

    let environ = fs::read_to_string("/proc/self/environ").unwrap();
    assert!(!environ.contains("SECRET"), "ENVIRON CONTAINS SECRET:\n{environ}");
}

$  SECRET=test cargo run
thread 'main' panicked at src/main.rs:10:5:
ENVIRON CONTAINS SECRET:
 [truncated]

Possible Solutions

The simplest solution would be relying on the ptrace isolation and always spawning a new process by changing birdcage's API to create a new command. With an additional PID namespace the guarantees could be even further reinforced.

Fixed in


          0.7.0

References

Updated Dec 01, 2023 · Source: OSV.dev

Aug 31, 2023

0.3.0 unknown

1 CVE

GHSA-wj7f-468m-6mv8 Dec 01, 2023

Environment variables still accessible through /proc

4.0 / 10

Medium

Local Low None None Unchanged Low None None

Impact

Environment variables can be read from procfs unless a new process is started.

PoC

use birdcage::{Birdcage, Sandbox};
use std::{env, fs};

fn main() {
    Birdcage::new().lock().unwrap();

    assert_eq!(env::var_os("SECRET"), None);

    let environ = fs::read_to_string("/proc/self/environ").unwrap();
    assert!(!environ.contains("SECRET"), "ENVIRON CONTAINS SECRET:\n{environ}");
}

$  SECRET=test cargo run
thread 'main' panicked at src/main.rs:10:5:
ENVIRON CONTAINS SECRET:
 [truncated]

Possible Solutions

The simplest solution would be relying on the ptrace isolation and always spawning a new process by changing birdcage's API to create a new command. With an additional PID namespace the guarantees could be even further reinforced.

Fixed in


          0.7.0

References

Updated Dec 01, 2023 · Source: OSV.dev

Aug 31, 2023

0.2.2 unknown

1 CVE

GHSA-wj7f-468m-6mv8 Dec 01, 2023

Environment variables still accessible through /proc

4.0 / 10

Medium

Local Low None None Unchanged Low None None

Impact

Environment variables can be read from procfs unless a new process is started.

PoC

use birdcage::{Birdcage, Sandbox};
use std::{env, fs};

fn main() {
    Birdcage::new().lock().unwrap();

    assert_eq!(env::var_os("SECRET"), None);

    let environ = fs::read_to_string("/proc/self/environ").unwrap();
    assert!(!environ.contains("SECRET"), "ENVIRON CONTAINS SECRET:\n{environ}");
}

$  SECRET=test cargo run
thread 'main' panicked at src/main.rs:10:5:
ENVIRON CONTAINS SECRET:
 [truncated]

Possible Solutions

The simplest solution would be relying on the ptrace isolation and always spawning a new process by changing birdcage's API to create a new command. With an additional PID namespace the guarantees could be even further reinforced.

Fixed in


          0.7.0

References

Updated Dec 01, 2023 · Source: OSV.dev

Aug 29, 2023

0.2.1 unknown yanked

1 CVE

GHSA-wj7f-468m-6mv8 Dec 01, 2023

Environment variables still accessible through /proc

4.0 / 10

Medium

Local Low None None Unchanged Low None None

Impact

Environment variables can be read from procfs unless a new process is started.

PoC

use birdcage::{Birdcage, Sandbox};
use std::{env, fs};

fn main() {
    Birdcage::new().lock().unwrap();

    assert_eq!(env::var_os("SECRET"), None);

    let environ = fs::read_to_string("/proc/self/environ").unwrap();
    assert!(!environ.contains("SECRET"), "ENVIRON CONTAINS SECRET:\n{environ}");
}

$  SECRET=test cargo run
thread 'main' panicked at src/main.rs:10:5:
ENVIRON CONTAINS SECRET:
 [truncated]

Possible Solutions

The simplest solution would be relying on the ptrace isolation and always spawning a new process by changing birdcage's API to create a new command. With an additional PID namespace the guarantees could be even further reinforced.

Fixed in


          0.7.0

References

Updated Dec 01, 2023 · Source: OSV.dev

Mar 29, 2023

0.2.0 unknown yanked

1 CVE

GHSA-wj7f-468m-6mv8 Dec 01, 2023

Environment variables still accessible through /proc

4.0 / 10

Medium

Local Low None None Unchanged Low None None

Impact

Environment variables can be read from procfs unless a new process is started.

PoC

use birdcage::{Birdcage, Sandbox};
use std::{env, fs};

fn main() {
    Birdcage::new().lock().unwrap();

    assert_eq!(env::var_os("SECRET"), None);

    let environ = fs::read_to_string("/proc/self/environ").unwrap();
    assert!(!environ.contains("SECRET"), "ENVIRON CONTAINS SECRET:\n{environ}");
}

$  SECRET=test cargo run
thread 'main' panicked at src/main.rs:10:5:
ENVIRON CONTAINS SECRET:
 [truncated]

Possible Solutions

The simplest solution would be relying on the ptrace isolation and always spawning a new process by changing birdcage's API to create a new command. With an additional PID namespace the guarantees could be even further reinforced.

Fixed in


          0.7.0

References

Updated Dec 01, 2023 · Source: OSV.dev

Feb 07, 2023

0.1.0 unknown

1 CVE

GHSA-wj7f-468m-6mv8 Dec 01, 2023

Environment variables still accessible through /proc

4.0 / 10

Medium

Local Low None None Unchanged Low None None

Impact

Environment variables can be read from procfs unless a new process is started.

PoC

use birdcage::{Birdcage, Sandbox};
use std::{env, fs};

fn main() {
    Birdcage::new().lock().unwrap();

    assert_eq!(env::var_os("SECRET"), None);

    let environ = fs::read_to_string("/proc/self/environ").unwrap();
    assert!(!environ.contains("SECRET"), "ENVIRON CONTAINS SECRET:\n{environ}");
}

$  SECRET=test cargo run
thread 'main' panicked at src/main.rs:10:5:
ENVIRON CONTAINS SECRET:
 [truncated]

Possible Solutions

The simplest solution would be relying on the ptrace isolation and always spawning a new process by changing birdcage's API to create a new command. With an additional PID namespace the guarantees could be even further reinforced.

Fixed in


          0.7.0

References

Updated Dec 01, 2023 · Source: OSV.dev

Oct 19, 2022

Activity

Details

Impact

PoC

Possible Solutions

Impact

PoC

Possible Solutions

Impact

PoC

Possible Solutions

Impact

PoC

Possible Solutions

Impact

PoC

Possible Solutions

Impact

PoC

Possible Solutions

Impact

PoC

Possible Solutions

Impact

PoC

Possible Solutions

Impact

PoC

Possible Solutions

Impact

PoC

Possible Solutions