Bugzilla – Bug 1223110
VUL-0: CVE-2024-32462: flatpak,xdg-desktop-portal: sandbox escape via RequestBackground portal
Last modified: 2024-06-18 12:30:06 UTC
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32462 https://seclists.org/oss-sec/2024/q2/143 https://github.com/flatpak/flatpak/security/advisories/GHSA-phv6-cpc2-2fgj https://www.cve.org/CVERecord?id=CVE-2024-32462 https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d https://github.com/flatpak/flatpak/commit/81abe2a37d363f5099c3d0bdcd0caad6efc5bf97 https://github.com/flatpak/flatpak/commit/b7c1a558e58aaeb1d007d29529bbb270dc4ff11e https://github.com/flatpak/flatpak/commit/bbab7ed1e672356d1a78b422462b210e8e875931 https://bugzilla.redhat.com/show_bug.cgi?id=2275981
SUSE-SU-2024:1536-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1223110 CVE References: CVE-2024-32462 Maintenance Incident: [SUSE:Maintenance:33593](https://smelt.suse.de/incident/33593/) Sources used: openSUSE Leap 15.5 (src): flatpak-1.14.5-150500.3.9.1 Desktop Applications Module 15-SP5 (src): flatpak-1.14.5-150500.3.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1535-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1223110 CVE References: CVE-2024-32462 Maintenance Incident: [SUSE:Maintenance:33594](https://smelt.suse.de/incident/33594/) Sources used: openSUSE Leap 15.4 (src): flatpak-1.12.8-150400.3.6.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): flatpak-1.12.8-150400.3.6.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): flatpak-1.12.8-150400.3.6.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): flatpak-1.12.8-150400.3.6.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): flatpak-1.12.8-150400.3.6.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): flatpak-1.12.8-150400.3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1548-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1223110 CVE References: CVE-2024-32462 Maintenance Incident: [SUSE:Maintenance:33597](https://smelt.suse.de/incident/33597/) Sources used: SUSE Linux Enterprise High Performance Computing 12 SP5 (src): flatpak-1.4.2-3.6.1 SUSE Linux Enterprise Server 12 SP5 (src): flatpak-1.4.2-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): flatpak-1.4.2-3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1547-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1223110 CVE References: CVE-2024-32462 Maintenance Incident: [SUSE:Maintenance:33596](https://smelt.suse.de/incident/33596/) Sources used: SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): flatpak-1.10.8-150200.4.18.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): flatpak-1.10.8-150200.4.18.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): flatpak-1.10.8-150200.4.18.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): flatpak-1.10.8-150200.4.18.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): flatpak-1.10.8-150200.4.18.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): flatpak-1.10.8-150200.4.18.1 SUSE Enterprise Storage 7.1 (src): flatpak-1.10.8-150200.4.18.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Please evaluate additional mitigations added in xdg-desktop-portal 1.18.4. https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.18.4 > Don't allow commandline arrays when the first commandline item starts > with whitespace or hyphen. (CVE-2024-32462) https://github.com/flatpak/xdg-desktop-portal/commit/0cad9ea9d8aec9c8c504f83a0201a56b55e7cd44 https://github.com/flatpak/xdg-desktop-portal/commit/cfaad5bcd7a51d15664928ea9cd45ae39d71f97e > background: Improve validation of commandline option > > Check that the first commandline item doesn't start with whitespaces or > a hyphen. > > Also sneakily plug a memory leak, g_variant_get_strv() is transfer- > container. Switch to g_autofree on the variable. > > Mitigates: CVE-2024-32462
SUSE-SU-2024:1803-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1223110 CVE References: CVE-2024-32462 Maintenance Incident: [SUSE:Maintenance:34040](https://smelt.suse.de/incident/34040/) Sources used: openSUSE Leap 15.5 (src): xdg-desktop-portal-1.16.0-150500.3.6.1 Desktop Applications Module 15-SP5 (src): xdg-desktop-portal-1.16.0-150500.3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1806-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1223110 CVE References: CVE-2024-32462 Maintenance Incident: [SUSE:Maintenance:34041](https://smelt.suse.de/incident/34041/) Sources used: openSUSE Leap 15.4 (src): xdg-desktop-portal-1.10.1-150400.3.6.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): xdg-desktop-portal-1.10.1-150400.3.6.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): xdg-desktop-portal-1.10.1-150400.3.6.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): xdg-desktop-portal-1.10.1-150400.3.6.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): xdg-desktop-portal-1.10.1-150400.3.6.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): xdg-desktop-portal-1.10.1-150400.3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1832-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1223110 CVE References: CVE-2024-32462 Maintenance Incident: [SUSE:Maintenance:34043](https://smelt.suse.de/incident/34043/) Sources used: SUSE Linux Enterprise High Performance Computing 12 SP5 (src): xdg-desktop-portal-1.4.2-3.3.1 SUSE Linux Enterprise Server 12 SP5 (src): xdg-desktop-portal-1.4.2-3.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): xdg-desktop-portal-1.4.2-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1831-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1223110 CVE References: CVE-2024-32462 Maintenance Incident: [SUSE:Maintenance:34042](https://smelt.suse.de/incident/34042/) Sources used: SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): xdg-desktop-portal-1.8.0-150200.5.6.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): xdg-desktop-portal-1.8.0-150200.5.6.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): xdg-desktop-portal-1.8.0-150200.5.6.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): xdg-desktop-portal-1.8.0-150200.5.6.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): xdg-desktop-portal-1.8.0-150200.5.6.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): xdg-desktop-portal-1.8.0-150200.5.6.1 SUSE Enterprise Storage 7.1 (src): xdg-desktop-portal-1.8.0-150200.5.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:2067-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1223110 CVE References: CVE-2024-32462 Maintenance Incident: [SUSE:Maintenance:34222](https://smelt.suse.de/incident/34222/) Sources used: openSUSE Leap 15.6 (src): xdg-desktop-portal-1.18.2-150600.4.3.1 Desktop Applications Module 15-SP6 (src): xdg-desktop-portal-1.18.2-150600.4.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.