Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
Flatpak portal accepts paths provided in sandbox-expose options without proper verification that they do not point to symlinks controlled by the application. An application running in the sandbox can provide a path that is a symlink pointing to any location on the host. The 'flatpak run' command resolves this symlink and mounts the indicated host path inside the sandbox, giving the application unrestricted access to system files. This mechanism can then be exploited as a primitive to achieve code execution (RCE) in the host context.
An attacker (or malicious Flatpak application) can gain access to all files on the host system and execute arbitrary code outside the sandbox, fully compromising the operating system's security.
Flatpak should be updated to version 1.16.4 or newer, in which the vulnerability has been fixed. Patches are available in the vendor's repository and in the official security advisory.
Flatpak in all versions before 1.16.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XFlatpak
APPFlatpak≤ 1.16.3
Related vulnerabilities
Flatpak: ucieczka z sandbox przez symlink w katalogu persistent
Flatpak: wstrzyknięcie komend przez TIOCLINUX na wirtualnych konsolach Linux
Flatpak — bypass sandbox przez obejście filtra seccomp (TIOCSTI)
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so r...
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versio...