Threat Intelligence Database

A security vulnerability (CVE-2024-42472) affects bubblewrap and flatpak on Red Hat Enterprise Linux 9. The issue allows applications using the persistent= (--persist) option in flatpak to access files outside their sandbox. Bubblewrap is a core execution engine for unprivileged containers and operates as a setuid binary on kernels without user namespaces. Red Hat has issued an important security update addressing this vulnerability.

Flatpak versions prior to 1.10.9, 1.12.9, 1.14.6, and 1.15.8 contain a vulnerability allowing a malicious or compromised Flatpak app to execute arbitrary code outside its sandbox. This occurs due to improper handling of the --command argument in flatpak run, which can be exploited via the org.freedesktop.portal.Background.RequestBackground interface to pass arguments directly to bubblewrap (bwrap), enabling sandbox escape. The vulnerability is addressed by passing the -- argument to bwrap to stop option processing, and mitigated in xdg-desktop-portal 1.18.4 by restricting command creation. Patches are available in the specified fixed versions.