CVE-2024-32462

Flatpak is a system for building, distributing, and running sandboxed
desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6,
and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary
code outside its sandbox. Normally, the --command argument of flatpak run expects to be given a command to run in the specified Flatpak app,
optionally along with some arguments. However it is possible to instead
pass bwrap arguments to --command=, such as --bind. It’s possible to
pass an arbitrary commandline to the portal interface
org.freedesktop.portal.Background.RequestBackground from within a Flatpak
app. When this is converted into a --command and arguments, it achieves
the same effect of passing arguments directly to bwrap, and thus can be
used for a sandbox escape. The solution is to pass the -- argument to
bwrap, which makes it stop processing options. This has been supported
since bubblewrap 0.3.0. All supported versions of Flatpak require at least
that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate
this vulnerability by only allowing Flatpak apps to create .desktop files
for commands that do not start with --. The vulnerability is patched in
1.15.8, 1.10.9, 1.12.9, and 1.14.6.

Bugs

• <https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/2062406&gt;