CVE-2024-42472
Published: 15 August 2024
Summary
CVE-2024-42472 is a critical-severity Injection (CWE-74) vulnerability in Flatpak Flatpak. Its CVSS base score is 10.0 (Critical).
Operationally, ranked in the top 8.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Flatpak is a Linux application sandboxing and distribution framework that is affected by CVE-2024-42472 in versions prior to 1.14.10 and 1.15.10. The vulnerability arises when an application declares the persistent sub-directory permission (represented as --persist=subdir), which normally maps a writable sub-directory inside the sandbox to storage under ~/.var/app/$APPID. Because the application also has write access to the parent ~/.var/app/$APPID directory, an attacker can replace the intended source path with a symlink; on the next launch the bind-mount operation follows the symlink and exposes arbitrary host paths inside the sandbox, violating the intended integrity and confidentiality boundaries.
A malicious or already-compromised Flatpak application can therefore read from and write to locations outside its declared sandbox, including files belonging to the user or other applications. Exploitation requires only that the target application has been granted the persistent permission; no additional user interaction or network access is needed once the malicious application is installed and executed.
The referenced commits and release notes prescribe updating Flatpak to 1.14.10 or 1.15.10 (which also ships patched bubblewrap 0.6.3 or 0.10.0) and, when system bubblewrap is used, applying the corresponding --bind-fd changes to the distribution-supplied bwrap binary. Long-term-support distributions are advised to back-port the individual fixes. As a workaround, administrators can avoid installing or running any Flatpak applications that request the persistent permission. The EPSS score has remained flat at 0.0654 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-39634
Vulnerability details
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is…
more
an attack on integrity and confidentiality. When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access. However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code. For the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson "wrap" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.