{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-32462", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-04-12T19:41:51.164Z", "datePublished": "2024-04-18T18:11:27.680Z", "dateUpdated": "2024-08-02T02:13:39.161Z"}, "containers": {"cna": {"title": "Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing", "problemTypes": [{"descriptions": [{"cweId": "CWE-88", "lang": "en", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/flatpak/flatpak/security/advisories/GHSA-phv6-cpc2-2fgj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-phv6-cpc2-2fgj"}, {"name": "https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d", "tags": ["x_refsource_MISC"], "url": "https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d"}, {"name": "https://github.com/flatpak/flatpak/commit/81abe2a37d363f5099c3d0bdcd0caad6efc5bf97", "tags": ["x_refsource_MISC"], "url": "https://github.com/flatpak/flatpak/commit/81abe2a37d363f5099c3d0bdcd0caad6efc5bf97"}, {"name": "https://github.com/flatpak/flatpak/commit/b7c1a558e58aaeb1d007d29529bbb270dc4ff11e", "tags": ["x_refsource_MISC"], "url": "https://github.com/flatpak/flatpak/commit/b7c1a558e58aaeb1d007d29529bbb270dc4ff11e"}, {"name": "https://github.com/flatpak/flatpak/commit/bbab7ed1e672356d1a78b422462b210e8e875931", "tags": ["x_refsource_MISC"], "url": "https://github.com/flatpak/flatpak/commit/bbab7ed1e672356d1a78b422462b210e8e875931"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFNSCFJVMAQK5AF55JBN7OSJP3CREDBD/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IB6VQAF5S2YOBULDHPUKPOEIKONOP5KO/"}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/18/5"}], "affected": [{"vendor": "flatpak", "product": "flatpak", "versions": [{"version": "< 1.10.9", "status": "affected"}, {"version": ">= 1.12.0, < 1.12.9", "status": "affected"}, {"version": ">= 1.14.0, < 1.14.6", "status": "affected"}, {"version": ">= 1.15.0, < 1.15.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-18T18:11:27.680Z"}, "descriptions": [{"lang": "en", "value": "Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6."}], "source": {"advisory": "GHSA-phv6-cpc2-2fgj", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32462", "role": "CISA Coordinator", "options": [{"Exploitation": "None"}, {"Automatable": "No"}, {"Technical Impact": "Total"}], "version": "2.0.3", "timestamp": "2024-04-20T04:00:12.336436Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*"], "vendor": "flatpak", "product": "flatpak", "versions": [{"status": "affected", "version": "1.15.0", "lessThan": "1.15.8", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:51:25.150Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:13:39.161Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/flatpak/flatpak/security/advisories/GHSA-phv6-cpc2-2fgj", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-phv6-cpc2-2fgj"}, {"name": "https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d"}, {"name": "https://github.com/flatpak/flatpak/commit/81abe2a37d363f5099c3d0bdcd0caad6efc5bf97", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/flatpak/flatpak/commit/81abe2a37d363f5099c3d0bdcd0caad6efc5bf97"}, {"name": "https://github.com/flatpak/flatpak/commit/b7c1a558e58aaeb1d007d29529bbb270dc4ff11e", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/flatpak/flatpak/commit/b7c1a558e58aaeb1d007d29529bbb270dc4ff11e"}, {"name": "https://github.com/flatpak/flatpak/commit/bbab7ed1e672356d1a78b422462b210e8e875931", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/flatpak/flatpak/commit/bbab7ed1e672356d1a78b422462b210e8e875931"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFNSCFJVMAQK5AF55JBN7OSJP3CREDBD/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IB6VQAF5S2YOBULDHPUKPOEIKONOP5KO/", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/18/5", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-phv6-cpc2-2fgj", "name": "https://github.com/flatpak/flatpak/security/advisories/GHSA-phv6-cpc2-2fgj", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d", "name": "https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/flatpak/flatpak/commit/81abe2a37d363f5099c3d0bdcd0caad6efc5bf97", "name": "https://github.com/flatpak/flatpak/commit/81abe2a37d363f5099c3d0bdcd0caad6efc5bf97", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/flatpak/flatpak/commit/b7c1a558e58aaeb1d007d29529bbb270dc4ff11e", "name": "https://github.com/flatpak/flatpak/commit/b7c1a558e58aaeb1d007d29529bbb270dc4ff11e", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/flatpak/flatpak/commit/bbab7ed1e672356d1a78b422462b210e8e875931", "name": "https://github.com/flatpak/flatpak/commit/bbab7ed1e672356d1a78b422462b210e8e875931", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFNSCFJVMAQK5AF55JBN7OSJP3CREDBD/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IB6VQAF5S2YOBULDHPUKPOEIKONOP5KO/", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/18/5", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:13:39.161Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32462", "role": "CISA Coordinator", "options": [{"Exploitation": "None"}, {"Automatable": "No"}, {"Technical Impact": "Total"}], "version": "2.0.3", "timestamp": "2024-04-20T04:00:12.336436Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*"], "vendor": "flatpak", "product": "flatpak", "versions": [{"status": "affected", "version": "1.15.0", "lessThan": "1.15.8", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-04-24T14:11:16.557Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing", "source": {"advisory": "GHSA-phv6-cpc2-2fgj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "flatpak", "product": "flatpak", "versions": [{"status": "affected", "version": "< 1.10.9"}, {"status": "affected", "version": ">= 1.12.0, < 1.12.9"}, {"status": "affected", "version": ">= 1.14.0, < 1.14.6"}, {"status": "affected", "version": ">= 1.15.0, < 1.15.8"}]}], "references": [{"url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-phv6-cpc2-2fgj", "name": "https://github.com/flatpak/flatpak/security/advisories/GHSA-phv6-cpc2-2fgj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d", "name": "https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/flatpak/flatpak/commit/81abe2a37d363f5099c3d0bdcd0caad6efc5bf97", "name": "https://github.com/flatpak/flatpak/commit/81abe2a37d363f5099c3d0bdcd0caad6efc5bf97", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/flatpak/flatpak/commit/b7c1a558e58aaeb1d007d29529bbb270dc4ff11e", "name": "https://github.com/flatpak/flatpak/commit/b7c1a558e58aaeb1d007d29529bbb270dc4ff11e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/flatpak/flatpak/commit/bbab7ed1e672356d1a78b422462b210e8e875931", "name": "https://github.com/flatpak/flatpak/commit/bbab7ed1e672356d1a78b422462b210e8e875931", "tags": ["x_refsource_MISC"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFNSCFJVMAQK5AF55JBN7OSJP3CREDBD/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IB6VQAF5S2YOBULDHPUKPOEIKONOP5KO/"}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/18/5"}], "descriptions": [{"lang": "en", "value": "Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-18T18:11:27.680Z"}}}, "cveMetadata": {"cveId": "CVE-2024-32462", "state": "PUBLISHED", "dateUpdated": "2024-08-02T02:13:39.161Z", "dateReserved": "2024-04-12T19:41:51.164Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-04-18T18:11:27.680Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6."}, {"lang": "es", "value": "Flatpak es un sistema para crear, distribuir y ejecutar aplicaciones de escritorio en espacio aislado en Linux. en versiones anteriores a la 1.10.9, 1.12.9, 1.14.6 y 1.15.8, una aplicaci\u00f3n Flatpak maliciosa o comprometida podr\u00eda ejecutar c\u00f3digo arbitrario fuera de su zona de pruebas. Normalmente, el argumento `--command` de `flatpak run` espera recibir un comando para ejecutar en la aplicaci\u00f3n Flatpak especificada, opcionalmente junto con algunos argumentos. Sin embargo, es posible pasar argumentos `bwrap` a `--command=`, como `--bind`. Es posible pasar una \"l\u00ednea de comando\" arbitraria a la interfaz del portal \"org.freedesktop.portal.Background.RequestBackground\" desde una aplicaci\u00f3n Flatpak. Cuando esto se convierte en un `--command` y argumentos, logra el mismo efecto de pasar argumentos directamente a `bwrap` y, por lo tanto, puede usarse para un escape sandbox. La soluci\u00f3n es pasar el argumento `--` a `bwrap`, lo que hace que deje de procesar las opciones. Esto ha sido compatible desde bubblewrap 0.3.0. Todas las versiones compatibles de Flatpak requieren al menos esa versi\u00f3n de bubblewrap. xdg-desktop-portal versi\u00f3n 1.18.4 mitigar\u00e1 esta vulnerabilidad al permitir que las aplicaciones Flatpak solo creen archivos .desktop para comandos que no comiencen con --. La vulnerabilidad est\u00e1 parcheada en 1.15.8, 1.10.9, 1.12.9 y 1.14.6."}], "id": "CVE-2024-32462", "lastModified": "2024-05-01T18:15:24.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-04-18T18:15:09.313", "references": [{"source": "security-advisories@github.com", "url": "http://www.openwall.com/lists/oss-security/2024/04/18/5"}, {"source": "security-advisories@github.com", "url": "https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d"}, {"source": "security-advisories@github.com", "url": "https://github.com/flatpak/flatpak/commit/81abe2a37d363f5099c3d0bdcd0caad6efc5bf97"}, {"source": "security-advisories@github.com", "url": "https://github.com/flatpak/flatpak/commit/b7c1a558e58aaeb1d007d29529bbb270dc4ff11e"}, {"source": "security-advisories@github.com", "url": "https://github.com/flatpak/flatpak/commit/bbab7ed1e672356d1a78b422462b210e8e875931"}, {"source": "security-advisories@github.com", "url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-phv6-cpc2-2fgj"}, {"source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IB6VQAF5S2YOBULDHPUKPOEIKONOP5KO/"}, {"source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFNSCFJVMAQK5AF55JBN7OSJP3CREDBD/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:3980", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "flatpak-0:1.0.9-13.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2024-06-18T00:00:00Z"}, {"advisory": "RHSA-2024:3961", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "flatpak-0:1.12.9-1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-06-17T00:00:00Z"}, {"advisory": "RHSA-2024:3979", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "flatpak-0:1.6.2-7.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2024-06-18T00:00:00Z"}, {"advisory": "RHSA-2024:3963", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "flatpak-0:1.8.5-5.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2024-06-17T00:00:00Z"}, {"advisory": "RHSA-2024:3963", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "flatpak-0:1.8.5-5.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2024-06-17T00:00:00Z"}, {"advisory": "RHSA-2024:3963", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "flatpak-0:1.8.5-5.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2024-06-17T00:00:00Z"}, {"advisory": "RHSA-2024:3969", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "flatpak-0:1.8.7-2.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-06-18T00:00:00Z"}, {"advisory": "RHSA-2024:3969", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "flatpak-0:1.8.7-2.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-06-18T00:00:00Z"}, {"advisory": "RHSA-2024:3969", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "flatpak-0:1.8.7-2.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-06-18T00:00:00Z"}, {"advisory": "RHSA-2024:3962", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "flatpak-0:1.10.7-2.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-06-17T00:00:00Z"}, {"advisory": "RHSA-2024:3959", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "flatpak-0:1.12.9-1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-06-17T00:00:00Z"}, {"advisory": "RHSA-2024:3970", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "flatpak-0:1.12.5-3.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2024-06-18T00:00:00Z"}, {"advisory": "RHSA-2024:3960", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "flatpak-0:1.12.7-3.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-06-17T00:00:00Z"}], "bugzilla": {"description": "flatpak: sandbox escape via RequestBackground portal", "id": "2275981", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2275981"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "status": "verified"}, "cwe": "CWE-88", "details": ["Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.", "A flaw was found in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. Normally, the \"--command\" argument of \"flatpak run\" expects being given a command to run in the specified Flatpak app, along with optional arguments. However, it is possible to pass bwrap arguments to \"--command=\" instead, such as \"--bind\". It is possible to pass an arbitrary \"commandline\" to the portal interface \"org.freedesktop.portal.Background.RequestBackground\" within the Flatpak app. This is normally safe because it can only specify a command that exists inside the sandbox. When a crafted \"commandline\" is converted into a \"--command\" and arguments, the app could achieve the same effect of passing arguments directly to bwrap to achieve sandbox escape."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-32462", "public_date": "2024-04-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-32462\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-32462\nhttps://github.com/flatpak/flatpak/security/advisories/GHSA-phv6-cpc2-2fgj"], "statement": "This vulnerability poses an important security risk due to its potential for sandbox escape within Flatpak environments. Exploiting this vulnerability allows a malicious Flatpak application to execute arbitrary code outside of its designated sandbox, effectively bypassing the security measures intended to restrict its system access. By manipulating the --command argument and the org.freedesktop.portal.Background.RequestBackground portal interface, an attacker can craft commands that are misinterpreted as bwrap options, leading to unauthorized execution of commands with elevated privileges. This could result in unauthorized data access, system compromise, and potentially enable further exploitation of the host system.", "threat_severity": "Important", "upstream_fix": "flatpak 1.15.8, flatpak 1.10.9, flatpak 1.12.9, flatpak 1.14.6"}