A critical sandbox escape vulnerability in the bubblewrap utility, affecting various Red Hat Enterprise Linux versions, allows local attackers to gain unauthorized access to the host filesystem.

This flaw involves improper link resolution (CWE-59) during the sandbox initialization process, where the application fails to safely handle parent symlinks. An attacker with local access and low privileges can exploit this to write files outside the intended sandbox boundary.

The ability to write arbitrary files to the host system from within a sandbox environment constitutes a significant security compromise. This breach of isolation can lead to full host system compromise, privilege escalation, and unauthorized data access, justifying the CVSS 8.8 High severity rating.

Immediate Action: Update the bubblewrap package to version 0.12.0 or later as provided by your Red Hat distribution channels.

Proactive Monitoring: Review system audit logs for unusual file write operations or unexpected processes executing with elevated permissions originating from sandboxed environments.

Compensating Controls: Restrict the ability of untrusted users to initiate sandboxed processes if an immediate update is not feasible.

Public Exploit Available: Unknown

Given the severity of this sandbox escape, organizations should prioritize patching all affected Red Hat Enterprise Linux systems. Failure to address this vulnerability allows local users to circumvent security boundaries, creating a direct path to host system compromise. Promptly applying the vendor provided update is the only effective way to neutralize this risk.