Threat database

CVE-2024-42472 is a security vulnerability in bubblewrap and flatpak on Red Hat Enterprise Linux 9 that allows applications using the persistent= (--persist) option in flatpak to access files outside their sandbox, potentially breaking container isolation. Bubblewrap is a core execution engine for unprivileged containers and runs as a setuid binary on kernels without user namespaces. Red Hat has issued an important security update to address this issue.

Flatpak versions prior to 1.10.9, 1.12.9, 1.14.6, and 1.15.8 contain a vulnerability that allows a malicious or compromised Flatpak application to execute arbitrary code outside its sandbox. This sandbox escape is due to improper handling of the --command argument in the flatpak run command, which can be exploited via the org.freedesktop.portal.Background.RequestBackground interface. The vulnerability is addressed by changes in how arguments are passed to bubblewrap (bwrap) and mitigated in xdg-desktop-portal 1.18.4 by restricting command creation. Patches are available in the specified fixed versions.