flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.
Security Fix(es):
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the --command
argument of flatpak run
expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass bwrap
arguments to --command=
, such as --bind
. It's possible to pass an arbitrary commandline
to the portal interface org.freedesktop.portal.Background.RequestBackground
from within a Flatpak app. When this is converted into a --command
and arguments, it achieves the same effect of passing arguments directly to bwrap
, and thus can be used for a sandbox escape. The solution is to pass the --
argument to bwrap
, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.(CVE-2024-32462)
{ "severity": "High" }
{ "x86_64": [ "flatpak-devel-1.0.3-12.oe1.x86_64.rpm", "flatpak-debugsource-1.0.3-12.oe1.x86_64.rpm", "flatpak-1.0.3-12.oe1.x86_64.rpm", "flatpak-debuginfo-1.0.3-12.oe1.x86_64.rpm" ], "noarch": [ "flatpak-help-1.0.3-12.oe1.noarch.rpm" ], "aarch64": [ "flatpak-1.0.3-12.oe1.aarch64.rpm", "flatpak-debuginfo-1.0.3-12.oe1.aarch64.rpm", "flatpak-devel-1.0.3-12.oe1.aarch64.rpm", "flatpak-debugsource-1.0.3-12.oe1.aarch64.rpm" ], "src": [ "flatpak-1.0.3-12.oe1.src.rpm" ] }
{ "x86_64": [ "flatpak-debugsource-1.0.3-12.oe2003sp4.x86_64.rpm", "flatpak-devel-1.0.3-12.oe2003sp4.x86_64.rpm", "flatpak-1.0.3-12.oe2003sp4.x86_64.rpm", "flatpak-debuginfo-1.0.3-12.oe2003sp4.x86_64.rpm" ], "noarch": [ "flatpak-help-1.0.3-12.oe2003sp4.noarch.rpm" ], "aarch64": [ "flatpak-1.0.3-12.oe2003sp4.aarch64.rpm", "flatpak-devel-1.0.3-12.oe2003sp4.aarch64.rpm", "flatpak-debuginfo-1.0.3-12.oe2003sp4.aarch64.rpm", "flatpak-debugsource-1.0.3-12.oe2003sp4.aarch64.rpm" ], "src": [ "flatpak-1.0.3-12.oe2003sp4.src.rpm" ] }
{ "x86_64": [ "flatpak-devel-1.10.2-8.oe2203.x86_64.rpm", "flatpak-1.10.2-8.oe2203.x86_64.rpm", "flatpak-debugsource-1.10.2-8.oe2203.x86_64.rpm", "flatpak-debuginfo-1.10.2-8.oe2203.x86_64.rpm", "flatpak-debuginfo-1.10.2-8.oe2203sp1.x86_64.rpm", "flatpak-devel-1.10.2-8.oe2203sp1.x86_64.rpm", "flatpak-debugsource-1.10.2-8.oe2203sp1.x86_64.rpm", "flatpak-1.10.2-8.oe2203sp1.x86_64.rpm", "flatpak-debugsource-1.10.2-8.oe2203sp2.x86_64.rpm", "flatpak-debuginfo-1.10.2-8.oe2203sp2.x86_64.rpm", "flatpak-1.10.2-8.oe2203sp2.x86_64.rpm", "flatpak-devel-1.10.2-8.oe2203sp2.x86_64.rpm", "flatpak-debugsource-1.10.2-8.oe2203sp3.x86_64.rpm", "flatpak-1.10.2-8.oe2203sp3.x86_64.rpm", "flatpak-devel-1.10.2-8.oe2203sp3.x86_64.rpm", "flatpak-debuginfo-1.10.2-8.oe2203sp3.x86_64.rpm" ], "noarch": [ "flatpak-help-1.10.2-8.oe2203.noarch.rpm", "flatpak-help-1.10.2-8.oe2203sp1.noarch.rpm", "flatpak-help-1.10.2-8.oe2203sp2.noarch.rpm", "flatpak-help-1.10.2-8.oe2203sp3.noarch.rpm" ], "aarch64": [ "flatpak-debugsource-1.10.2-8.oe2203.aarch64.rpm", "flatpak-1.10.2-8.oe2203.aarch64.rpm", "flatpak-debuginfo-1.10.2-8.oe2203.aarch64.rpm", "flatpak-devel-1.10.2-8.oe2203.aarch64.rpm", "flatpak-debugsource-1.10.2-8.oe2203sp1.aarch64.rpm", "flatpak-debuginfo-1.10.2-8.oe2203sp1.aarch64.rpm", "flatpak-1.10.2-8.oe2203sp1.aarch64.rpm", "flatpak-devel-1.10.2-8.oe2203sp1.aarch64.rpm", "flatpak-debuginfo-1.10.2-8.oe2203sp2.aarch64.rpm", "flatpak-1.10.2-8.oe2203sp2.aarch64.rpm", "flatpak-devel-1.10.2-8.oe2203sp2.aarch64.rpm", "flatpak-debugsource-1.10.2-8.oe2203sp2.aarch64.rpm", "flatpak-devel-1.10.2-8.oe2203sp3.aarch64.rpm", "flatpak-debugsource-1.10.2-8.oe2203sp3.aarch64.rpm", "flatpak-debuginfo-1.10.2-8.oe2203sp3.aarch64.rpm", "flatpak-1.10.2-8.oe2203sp3.aarch64.rpm" ], "src": [ "flatpak-1.10.2-8.oe2203.src.rpm", "flatpak-1.10.2-8.oe2203sp1.src.rpm", "flatpak-1.10.2-8.oe2203sp2.src.rpm", "flatpak-1.10.2-8.oe2203sp3.src.rpm" ] }
{ "x86_64": [ "flatpak-debuginfo-1.10.2-8.oe2203sp1.x86_64.rpm", "flatpak-devel-1.10.2-8.oe2203sp1.x86_64.rpm", "flatpak-debugsource-1.10.2-8.oe2203sp1.x86_64.rpm", "flatpak-1.10.2-8.oe2203sp1.x86_64.rpm" ], "noarch": [ "flatpak-help-1.10.2-8.oe2203sp1.noarch.rpm" ], "aarch64": [ "flatpak-debugsource-1.10.2-8.oe2203sp1.aarch64.rpm", "flatpak-debuginfo-1.10.2-8.oe2203sp1.aarch64.rpm", "flatpak-1.10.2-8.oe2203sp1.aarch64.rpm", "flatpak-devel-1.10.2-8.oe2203sp1.aarch64.rpm" ], "src": [ "flatpak-1.10.2-8.oe2203sp1.src.rpm" ] }
{ "x86_64": [ "flatpak-debugsource-1.10.2-8.oe2203sp2.x86_64.rpm", "flatpak-debuginfo-1.10.2-8.oe2203sp2.x86_64.rpm", "flatpak-1.10.2-8.oe2203sp2.x86_64.rpm", "flatpak-devel-1.10.2-8.oe2203sp2.x86_64.rpm" ], "noarch": [ "flatpak-help-1.10.2-8.oe2203sp2.noarch.rpm" ], "aarch64": [ "flatpak-debuginfo-1.10.2-8.oe2203sp2.aarch64.rpm", "flatpak-1.10.2-8.oe2203sp2.aarch64.rpm", "flatpak-devel-1.10.2-8.oe2203sp2.aarch64.rpm", "flatpak-debugsource-1.10.2-8.oe2203sp2.aarch64.rpm" ], "src": [ "flatpak-1.10.2-8.oe2203sp2.src.rpm" ] }
{ "x86_64": [ "flatpak-debugsource-1.10.2-8.oe2203sp3.x86_64.rpm", "flatpak-1.10.2-8.oe2203sp3.x86_64.rpm", "flatpak-devel-1.10.2-8.oe2203sp3.x86_64.rpm", "flatpak-debuginfo-1.10.2-8.oe2203sp3.x86_64.rpm" ], "noarch": [ "flatpak-help-1.10.2-8.oe2203sp3.noarch.rpm" ], "aarch64": [ "flatpak-devel-1.10.2-8.oe2203sp3.aarch64.rpm", "flatpak-debugsource-1.10.2-8.oe2203sp3.aarch64.rpm", "flatpak-debuginfo-1.10.2-8.oe2203sp3.aarch64.rpm", "flatpak-1.10.2-8.oe2203sp3.aarch64.rpm" ], "src": [ "flatpak-1.10.2-8.oe2203sp3.src.rpm" ] }