Home

CVE-2022-21682

Description

Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build against it will gain those permissions. Normally this will not be done, so this is not problem. However, if --mirror-screenshots-url is specified, then flatpak-builder will launch flatpak build --nofilesystem=host appstream-utils mirror-screenshots after finalization, which can lead to issues even with the --nofilesystem=host protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the appstream-util binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of --nofilesystem=home and --nofilesystem=host.

Risk Information

Base Score
6.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.336

Associated Vulnerability

VulnerabilityOS Platform
flatpak security update(DSA-5049-1) flatpak_1.10.7-0+deb11u1_amd64.debLinux
flatpak-builder security and bug fix update (RLSA-2022:7458) flatpak-builder-1.0.14-2.el8.x86_64.rpmLinux
SUSE-SU-2022:0712-1(SUSE Linux Enterprise Module for Desktop Applications 15-SP3 ) flatpak-1.10.7-4.12.1.x86_64.rpmLinux
SUSE-SU-2022:0712-1(SUSE Linux Enterprise Module for Desktop Applications 15-SP3 ) libflatpak0-1.10.7-4.12.1.x86_64.rpmLinux
SUSE-SU-2022:0712-1(SUSE Linux Enterprise Module for Desktop Applications 15-SP3 ) flatpak-devel-1.10.7-4.12.1.x86_64.rpmLinux
SUSE-SU-2022:0712-1(SUSE Linux Enterprise Module for Desktop Applications 15-SP3 ) flatpak-debuginfo-1.10.7-4.12.1.x86_64.rpmLinux
SUSE-SU-2022:0712-1(SUSE Linux Enterprise Module for Desktop Applications 15-SP3 ) flatpak-debugsource-1.10.7-4.12.1.x86_64.rpmLinux
SUSE-SU-2022:0712-1(SUSE Linux Enterprise Module for Desktop Applications 15-SP3 ) system-user-flatpak-1.10.7-4.12.1.x86_64.rpmLinux
SUSE-SU-2022:0712-1(SUSE Linux Enterprise Module for Desktop Applications 15-SP3 ) libflatpak0-debuginfo-1.10.7-4.12.1.x86_64.rpmLinux
SUSE-SU-2022:0712-1(SUSE Linux Enterprise Module for Desktop Applications 15-SP3 ) flatpak-zsh-completion-1.10.7-4.12.1.x86_64.rpmLinux
SUSE-SU-2022:0712-1(SUSE Linux Enterprise Module for Desktop Applications 15-SP3 ) typelib-1_0-Flatpak-1_0-1.10.7-4.12.1.x86_64.rpmLinux
(RHSA-2022:7458)Moderate: security and bug fix update flatpak-builder-1.0.14-2.el8.x86_64.rpmLinux
(RHSA-2022:7458)Moderate: security and bug fix update flatpak-builder-debuginfo-1.0.14-2.el8.x86_64.rpmLinux
(RHSA-2022:7458)Moderate: security and bug fix update flatpak-builder-debugsource-1.0.14-2.el8.x86_64.rpmLinux
flatpak security update(DSA-5049-1) flatpak_1.10.7-0+deb11u1_i386.debLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234