A vulnerability (CVE-2024-32462) has been identified in the Flatpak toolkit, which is designed for creating self-contained packages that are not bound to specific Linux distributions and are isolated from the rest of the system. This vulnerability enables a malicious or compromised application delivered in a flatpak package to circumvent the established sandbox isolation mode and access files in the host system. The issue only manifests in packages that utilize Freedesktop portals (xdg-desktop-portal), which are used to facilitate access to user environment resources from isolated applications. The vulnerability has been resolved in corrective updates of flatpak 1.15.8, 1.14.6, 1.12.9, and 1.10.9. A workaround for protection has also been proposed in the releases of xdg-desktop-portal 1.16.1 and 1.18.4.
Due to the vulnerability, an application running in an isolated environment can use the xdg-desktop-portal interface to create a '.desktop' file with a launch command for the application from flatpak, allowing access to files on the host system. To exit from the isolated environment, manipulations with the ‘—command’ parameter are used, which is employed to pass the name of the program located inside the flatpak package that needs to be launched in the isolated environment. To set up the isolated environment, flatpak calls the bwrap utility, passing it the specified program name. For example, to run the ls utility in the isolated environment of the package, one can use the construct ‘flatpak run —command=ls org.gnome.gedit’, which will result in the command ‘bwrap ls’.
The essence of the vulnerability is that if a program name begins with the characters ‘—’, it will be interpreted by the bwrap utility as its own option. For example, executing ‘flatpak run —command=—bind org.gnome.gedit / /host ls -l /host’ will result in the execution of ‘bwrap —bind / /host ls -l /host’, meaning the name ‘—bind’ will be processed not as the name of the program to be launched, but as an option for bwrap.
The vulnerability is exacerbated by the D-Bus interface "org.freedesktop.portal.Background.RequestBackground" allowing a Flatpak application to specify any command for execution using "flatpak run --command", including those starting with the "--" symbol. It was assumed that passing any commands was safe since they would run in the package's isolated environment. However, it was not taken into account that commands beginning with "--" would be interpreted as options by the bwrap utility. As a result, the xdg-desktop-portal interface can be used to create a ".desktop" file with a command that exploits the vulnerability.
Source: opennet.ru
