Flatpak up to 1.0.6/1.1.x/1.2.2 Script Sandbox /proc input validation

Summaryinfo

A vulnerability identified as critical has been detected in Flatpak up to 1.0.6/1.1.x/1.2.2. This affects an unknown function of the file /proc of the component Script Sandbox. The manipulation leads to input validation. This vulnerability is listed as CVE-2019-8308. The attack must be carried out locally. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Flatpak up to 1.0.6/1.1.x/1.2.2. This issue affects some unknown functionality of the file /proc of the component Script Sandbox. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.

The bug was discovered 02/11/2019. The weakness was presented 02/12/2019 (Website). The advisory is shared at access.redhat.com. The identification of this vulnerability is CVE-2019-8308 since 02/12/2019. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 351542 (Amazon Linux Security Advisory for flatpak: ALAS2-2019-1183).

Upgrading to version 1.0.7 or 1.2.3 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Flatpak

Version

• 1.0
• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.1
• 1.2.0
• 1.2.1
• 1.2.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion