CVE-2020-5291: 
NixOS vulnerability analysis and mitigation

CVE-2020-5291 affects Bubblewrap (bwrap) versions before 0.4.1 when installed in setuid mode. The vulnerability was discovered in March 2020 and impacts systems where both setuid mode is enabled and the kernel supports unprivileged user namespaces (GitHub Advisory).

The vulnerability exists in the bwrap --userns2 option functionality. When Bubblewrap is installed in setuid mode and the kernel supports unprivileged user namespaces, this option can be exploited to make the setuid process continue running as root while remaining traceable (NVD).

This vulnerability allows an attacker to gain root permissions on affected systems. The issue specifically affects systems running Bubblewrap in setuid mode, which is typically used when unprivileged user namespaces are not supported (GitHub Advisory).

The vulnerability was patched in Bubblewrap version 0.4.1. For systems that cannot immediately update, there are two workarounds: 1) On kernels after 4.9, setting /proc/sys/user/max_user_namespaces to 0 limits unprivileged user namespaces, 2) On certain patched kernels (like Debian's linux package and Arch Linux's linux-hardened), setting /proc/sys/kernel/unprivileged_userns_clone to 0 disables unprivileged creation of user namespaces (GitHub Advisory).