Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.
CVSS Details
- CVSS 3.1 Base Score: 8.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade flatpak-selinuxUpgrade flatpak-session-helperUpgrade flatpak-develUpgrade flatpakUpgrade flatpak-libs | Jun 20, 2024 | Apr 18, 2024 |
| Alpine Linux | — | Upgrade flatpak | Aug 22, 2024 | Apr 18, 2024 |
| Amazon Linux Ami 2 | — | Upgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpak-develUpgrade flatpak-builderUpgrade flatpak | May 16, 2024 | Apr 18, 2024 |
| Amazon_linux_2023 | — | Upgrade flatpak-tests-debuginfoUpgrade flatpak-develUpgrade flatpak-testsUpgrade flatpak-debuginfoUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-session-helperUpgrade flatpak-selinuxUpgrade flatpak-libs-debuginfoUpgrade flatpakUpgrade flatpak-debugsourceUpgrade flatpak-libs | Feb 17, 2025 | Apr 18, 2024 |
| Centos_linux | — | Upgrade flatpak-builderUpgrade flatpakUpgrade flatpak-develUpgrade flatpak-debuginfoUpgrade flatpak-libs | Jun 19, 2024 | Apr 18, 2024 |
| Debian | — | Upgrade flatpak | Apr 22, 2024 | Apr 18, 2024 |
| Gentoo Linux | — | Upgrade sys-apps/flatpak. | Jun 24, 2024 | Apr 18, 2024 |
| Oracle_linux | — | Upgrade flatpak-develUpgrade flatpakUpgrade flatpak-session-helperUpgrade flatpak-builderUpgrade flatpak-libsUpgrade flatpak-selinux | Jun 18, 2024 | Apr 18, 2024 |
| Redhat_linux | — | Upgrade flatpak-selinuxUpgrade flatpak-develUpgrade flatpak-tests-debuginfoUpgrade flatpak-session-helperUpgrade flatpak-debugsourceUpgrade flatpakUpgrade flatpak-libsUpgrade flatpak-builderUpgrade flatpak-libs-debuginfoUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-debuginfo | Jun 19, 2024 | Apr 18, 2024 |
| Rocky_linux | — | Upgrade flatpak-debuginfoUpgrade flatpak-libsUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-develUpgrade flatpak-libs-debuginfoUpgrade flatpakUpgrade flatpak-debugsourceUpgrade flatpak-session-helper | Jul 3, 2024 | Apr 18, 2024 |
| Suse | — | Upgrade bubblewrapUpgrade typelib-1_0-flatpak-1_0Upgrade xdg-desktop-portal-develUpgrade flatpakUpgrade flatpak-selinuxUpgrade wayland-protocols-develUpgrade flatpak-zsh-completionUpgrade xdg-desktop-portal-devel-docsUpgrade flatpak-remote-flathubUpgrade xdg-desktop-portalUpgrade libflatpak0Upgrade xdg-desktop-portal-langUpgrade bubblewrap-zsh-completionUpgrade flatpak-develUpgrade system-user-flatpak | May 7, 2024 | Apr 18, 2024 |
| Ubuntu | — | Upgrade flatpak | Nov 19, 2024 | Apr 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub