Linux users who rely on Flatpak to run sandboxed desktop applications might want to pay attention to a recent discovery.
A new vulnerability identified as CVE-2024-32462 has been found in Flatpak, potentially allowing malicious applications to execute commands outside of their secure environment.
Typically, applications running in Flatpak are limited to a secure environment where they can’t interact with the broader system. This setup is supposed to prevent any rogue app from harming the underlying system.
However, Gergo Koteles recently discovered a flaw where a Flatpak application could bypass this security through a mechanism involving the xdg-desktop-portal interface.
The flaw centers on misusing the --command parameter, which can unintentionally be tricked into executing additional commands. Attackers can manipulate the system to execute arbitrary commands outside the Flatpak sandbox by entering a sequence that includes --bind.
This could potentially allow a compromised application to cause broader harm to the user’s system, breaking Flatpak’s primary security feature.
Thankfully, the Flatpak team has promptly responded with patches to this vulnerability. Users are strongly encouraged to update their Flatpak installations to the following versions to ensure they are protected:
- For users on the stable branch, Flatpak version 1.14.6 or newer.
- For those on older stable branches, version 1.12.9 or 1.10.9 are the safe bets.
- Developers using the developmental branch should update to version 1.15.8 or above.
Please note that Flatpak’s versions older than 1.10.9, including the entire 1.8.x series are no longer supported and will not receive this crucial update.
You can perform a simple test to verify whether your system is affected. Install any Flatpak application and run it with the --command=--help followed by the application’s ID. If the system returns an error message stating that the help command is not found, your Flatpak installation is not vulnerable.
However, if it displays an output similar to that of the bwrap --help command, it means your version is still at risk.
For more detailed information and ongoing updates, visit Flatpak’s official security advisory page on GitHub.
