{"id":115168,"date":"2024-04-19T02:30:08","date_gmt":"2024-04-19T00:30:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-vo-flatpak-pozvolyayushhaya-obojti-sandbox-izolyacziyu"},"modified":"2024-04-19T02:30:08","modified_gmt":"2024-04-19T00:30:08","slug":"uyazvimost-vo-flatpak-pozvolyayushhaya-obojti-sandbox-izolyacziyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-vo-flatpak-pozvolyayushhaya-obojti-sandbox-izolyacziyu","title":{"rendered":"Flatpaki haavatavus, mis v\u00f5imaldab v\u00e4ltida sandbox-isolatsiooni","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Flatpaki t\u00f6\u00f6riistus, mis on m\u00f5eldud iseseisvate pakettide loomiseks, mis ei ole seotud konkreetsete Linuxi jaotustega ning on eraldatud \u00fclej\u00e4\u00e4nud s\u00fcsteemist, on tuvastatud haavatavus (CVE-2024-32462). See haavatavus v\u00f5imaldab pahatahtlikul v\u00f5i kompromiteeritud rakendusel, mis on pakettides flatpak, k\u00f5rvale hiilida kehtestatud sandbox-isolatsioonire\u017eimist ja p\u00e4\u00e4seda juurde failidele p\u00f5hiss\u00fcsteemis. Probleem ilmneb ainult pakettides, mis kasutavad Freedesktop'i porte (xdg-desktop-portal), mis on m\u00f5eldud juurdep\u00e4\u00e4suks kasutajakeskkonna ressurssidele eraldatud rakendustest. Haavatavus on k\u00f5rvaldatud flatpaki parandustes 1.15.8, 1.14.6, 1.12.9 ja 1.10.9. Kaitsmiseks on samuti pakutud lahendus xdg-desktop-portal'i v\u00e4ljaannetes 1.16.1 ja 1.18.4. <\/p>\n

Vea t\u00f5ttu saab isoleeritud keskkonnas olev rakendus kasutada xdg-desktop-portal liidest, et luua fail nimega «.desktop» rakenduse k\u00e4ivitamise k\u00e4suga flatpakist, v\u00f5imaldades juurdep\u00e4\u00e4su peamise s\u00fcsteemi failidele. Isoleeritud keskkonnast v\u00e4ljumiseks kasutatakse parameetri «—command» manipuleerimist, mis on ette n\u00e4htud sisemises flatpak-paketis oleva programmi nime edastamiseks, mida tuleb isoleeritud keskkonnas k\u00e4ivitada. Isoleeritud keskkonna seadistamiseks kutsub flatpak v\u00e4lja utiliidi bwrap, edastades sellele m\u00e4\u00e4ratud programmide nime. N\u00e4iteks, et k\u00e4ivitada utiliit ls isoleeritud keskkonnas, v\u00f5ib kasutada konstruktsiooni «flatpak run —command=ls org.gnome.gedit», mis toob kaasa «bwrap <isoleerimise_parameetrid> ls» k\u00e4ivitamise. <\/p>\n

Haavatavuse olemus seisneb selles, et kui programmi nimi algab m\u00e4rkidest «—«, t\u00f5lgendab utiliit bwrap seda kui oma valikut. N\u00e4iteks k\u00e4su «flatpak run —command=—bind org.gnome.gedit \\\/ \\\/host ls -l \\\/host» k\u00e4ivitamine viib «bwrap <isoleerimise_parameetrid> —bind \\\/ \\\/host ls -l \\\/host» t\u00e4itmiseni, st nimi «—bind» t\u00f6\u00f6deldakse mitte k\u00e4ivitatava rakenduse nime, vaid bwrap valikuna. <\/p>\n

Haavatavust s\u00fcvendab see, et D-Bus liides «org.freedesktop.portal.Background.RequestBackground» v\u00f5imaldab Flatpak paketi rakendusel m\u00e4\u00e4rata mis tahes k\u00e4su t\u00e4itmiseks «flatpak run —command», sealhulgas sellise, mis algab m\u00e4rgiga «—«. Eeldati, et mis tahes k\u00e4skude edastamine ei ole ohtlik, kuna need t\u00e4idetakse paketi isoleeritud keskkonnas. Kuid ei arvestatud, et k\u00e4sud, mis algavad «—», t\u00f6\u00f6deldakse bwrap utiliidi valikutena. Tulemuseks on see, et xdg-desktop-portal liidest saab kasutada faili «.desktop» loomiseks k\u00e4suga, mis ekspluateerib haavatavust.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 Flatpak, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u0430\u043c\u043e\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0435 \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043a \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u043c Linux \u0438 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u0442 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-32462). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u0438\u043b\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044e, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c\u0443 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 flatpak, \u043e\u0431\u043e\u0439\u0442\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0440\u0435\u0436\u0438\u043c sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u0440\u0442\u0430\u043b\u044b Freedesktop (xdg-desktop-portal), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0434\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115168","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Flatpak'i haavatavus, mis v\u00f5imaldab \u00fcletada sandbox-isolatsiooni | ProHoster","description":"Flatpak'i t\u00f6\u00f6riistades, mis on m\u00f5eldud iseseisvate pakettide loomiseks, mis ei s\u00f5ltu konkreetsetest Linuxi distributsioonidest ning on eraldatud \u00fclej\u00e4\u00e4nud s\u00fcsteemist, tuvastati haavatavus (CVE-2024-32462).","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-vo-flatpak-pozvolyayushhaya-obojti-sandbox-izolyacziyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e flatpak, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e | ProHoster","og:description":"\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 Flatpak, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u0430\u043c\u043e\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0435 \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043a \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u043c Linux \u0438 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u0442 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-32462).","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-vo-flatpak-pozvolyayushhaya-obojti-sandbox-izolyacziyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-19T00:30:08+00:00","article:modified_time":"2024-04-19T00:30:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115168","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 22:37:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 22:37:20","updated":"2026-01-22 22:37:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=115168"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115168\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=115168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=115168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=115168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}