Bug 1223110 (CVE-2024-32462)

Summary:	VUL-0: CVE-2024-32462: flatpak,xdg-desktop-portal: sandbox escape via RequestBackground portal
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Cliff Zhao <qzhao>
Status:	IN_PROGRESS ---	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P2 - High	CC:	Andreas.Stieger, os.gnome.maintainers, qzhao, rfrohl, security-team
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/402626/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-32462:8.4:(AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-04-19 07:15:26 UTC

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32462
https://seclists.org/oss-sec/2024/q2/143
https://github.com/flatpak/flatpak/security/advisories/GHSA-phv6-cpc2-2fgj
https://www.cve.org/CVERecord?id=CVE-2024-32462
https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d
https://github.com/flatpak/flatpak/commit/81abe2a37d363f5099c3d0bdcd0caad6efc5bf97
https://github.com/flatpak/flatpak/commit/b7c1a558e58aaeb1d007d29529bbb270dc4ff11e
https://github.com/flatpak/flatpak/commit/bbab7ed1e672356d1a78b422462b210e8e875931
https://bugzilla.redhat.com/show_bug.cgi?id=2275981

Comment 8 Maintenance Automation 2024-05-06 16:30:06 UTC

SUSE-SU-2024:1536-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1223110
CVE References: CVE-2024-32462
Maintenance Incident: [SUSE:Maintenance:33593](https://smelt.suse.de/incident/33593/)
Sources used:
openSUSE Leap 15.5 (src):
 flatpak-1.14.5-150500.3.9.1
Desktop Applications Module 15-SP5 (src):
 flatpak-1.14.5-150500.3.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 9 Maintenance Automation 2024-05-06 16:30:08 UTC

SUSE-SU-2024:1535-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1223110
CVE References: CVE-2024-32462
Maintenance Incident: [SUSE:Maintenance:33594](https://smelt.suse.de/incident/33594/)
Sources used:
openSUSE Leap 15.4 (src):
 flatpak-1.12.8-150400.3.6.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src):
 flatpak-1.12.8-150400.3.6.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src):
 flatpak-1.12.8-150400.3.6.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src):
 flatpak-1.12.8-150400.3.6.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src):
 flatpak-1.12.8-150400.3.6.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src):
 flatpak-1.12.8-150400.3.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 10 Maintenance Automation 2024-05-07 16:30:11 UTC

SUSE-SU-2024:1548-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1223110
CVE References: CVE-2024-32462
Maintenance Incident: [SUSE:Maintenance:33597](https://smelt.suse.de/incident/33597/)
Sources used:
SUSE Linux Enterprise High Performance Computing 12 SP5 (src):
 flatpak-1.4.2-3.6.1
SUSE Linux Enterprise Server 12 SP5 (src):
 flatpak-1.4.2-3.6.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src):
 flatpak-1.4.2-3.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Maintenance Automation 2024-05-07 16:30:13 UTC

SUSE-SU-2024:1547-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1223110
CVE References: CVE-2024-32462
Maintenance Incident: [SUSE:Maintenance:33596](https://smelt.suse.de/incident/33596/)
Sources used:
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src):
 flatpak-1.10.8-150200.4.18.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src):
 flatpak-1.10.8-150200.4.18.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src):
 flatpak-1.10.8-150200.4.18.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src):
 flatpak-1.10.8-150200.4.18.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src):
 flatpak-1.10.8-150200.4.18.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src):
 flatpak-1.10.8-150200.4.18.1
SUSE Enterprise Storage 7.1 (src):
 flatpak-1.10.8-150200.4.18.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 13 Andreas Stieger 2024-05-18 15:57:47 UTC

Please evaluate additional mitigations added in xdg-desktop-portal 1.18.4.

https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.18.4

> Don't allow commandline arrays when the first commandline item starts
> with whitespace or hyphen. (CVE-2024-32462)

https://github.com/flatpak/xdg-desktop-portal/commit/0cad9ea9d8aec9c8c504f83a0201a56b55e7cd44
https://github.com/flatpak/xdg-desktop-portal/commit/cfaad5bcd7a51d15664928ea9cd45ae39d71f97e

> background: Improve validation of commandline option
> 
> Check that the first commandline item doesn't start with whitespaces or
> a hyphen.
> 
> Also sneakily plug a memory leak, g_variant_get_strv() is transfer-
> container. Switch to g_autofree on the variable.
> 
> Mitigates: CVE-2024-32462

Comment 16 Maintenance Automation 2024-05-28 16:30:04 UTC

SUSE-SU-2024:1803-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1223110
CVE References: CVE-2024-32462
Maintenance Incident: [SUSE:Maintenance:34040](https://smelt.suse.de/incident/34040/)
Sources used:
openSUSE Leap 15.5 (src):
 xdg-desktop-portal-1.16.0-150500.3.6.1
Desktop Applications Module 15-SP5 (src):
 xdg-desktop-portal-1.16.0-150500.3.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 17 Maintenance Automation 2024-05-29 08:30:16 UTC

SUSE-SU-2024:1806-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1223110
CVE References: CVE-2024-32462
Maintenance Incident: [SUSE:Maintenance:34041](https://smelt.suse.de/incident/34041/)
Sources used:
openSUSE Leap 15.4 (src):
 xdg-desktop-portal-1.10.1-150400.3.6.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src):
 xdg-desktop-portal-1.10.1-150400.3.6.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src):
 xdg-desktop-portal-1.10.1-150400.3.6.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src):
 xdg-desktop-portal-1.10.1-150400.3.6.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src):
 xdg-desktop-portal-1.10.1-150400.3.6.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src):
 xdg-desktop-portal-1.10.1-150400.3.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 18 Maintenance Automation 2024-05-29 16:30:18 UTC

SUSE-SU-2024:1832-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1223110
CVE References: CVE-2024-32462
Maintenance Incident: [SUSE:Maintenance:34043](https://smelt.suse.de/incident/34043/)
Sources used:
SUSE Linux Enterprise High Performance Computing 12 SP5 (src):
 xdg-desktop-portal-1.4.2-3.3.1
SUSE Linux Enterprise Server 12 SP5 (src):
 xdg-desktop-portal-1.4.2-3.3.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src):
 xdg-desktop-portal-1.4.2-3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 19 Maintenance Automation 2024-05-29 16:30:19 UTC

SUSE-SU-2024:1831-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1223110
CVE References: CVE-2024-32462
Maintenance Incident: [SUSE:Maintenance:34042](https://smelt.suse.de/incident/34042/)
Sources used:
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src):
 xdg-desktop-portal-1.8.0-150200.5.6.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src):
 xdg-desktop-portal-1.8.0-150200.5.6.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src):
 xdg-desktop-portal-1.8.0-150200.5.6.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src):
 xdg-desktop-portal-1.8.0-150200.5.6.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src):
 xdg-desktop-portal-1.8.0-150200.5.6.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src):
 xdg-desktop-portal-1.8.0-150200.5.6.1
SUSE Enterprise Storage 7.1 (src):
 xdg-desktop-portal-1.8.0-150200.5.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 25 Maintenance Automation 2024-06-18 12:30:06 UTC

SUSE-SU-2024:2067-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1223110
CVE References: CVE-2024-32462
Maintenance Incident: [SUSE:Maintenance:34222](https://smelt.suse.de/incident/34222/)
Sources used:
openSUSE Leap 15.6 (src):
 xdg-desktop-portal-1.18.2-150600.4.3.1
Desktop Applications Module 15-SP6 (src):
 xdg-desktop-portal-1.18.2-150600.4.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.