CVE-2024-32462: Insufficient Information (NVD-CWE-noinfo)
value: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-18T18:15Z
Repository: https://github.com/flatpak/flatpak
Language: C
Files changed: app/flatpak-builtins-build.c, common/flatpak-dir.c, common/flatpak-run-dbus.c, common/flatpak-run.c
Commit date: 2024-04-17 18:10:31 +0100
Commit message: When starting non-static command using bwrap use "--"

This ensures that the command is not taken to be a bwrap option.

Resolves: CVE-2024-32462
Resolves: GHSA-phv6-cpc2-2fgj
Signed-off-by: Alexander Larsson <alexl@redhat.com>
[smcv: Fix DISABLE_SANDBOXED_TRIGGERS code path]
[smcv: Make flatpak_run_maybe_start_dbus_proxy() more obviously correct]
Signed-off-by: Simon McVittie <smcv@collabora.com>

Diff: diff --git a/app/flatpak-builtins-build.c b/app/flatpak-builtins-build.c
index a606544980..585f8f43ba 100644
--- a/app/flatpak-builtins-build.c
+++ b/app/flatpak-builtins-build.c
@@ -587,11 +587,12 @@ flatpak_builtin_build (int argc, char **argv, GCancellable *cancellable, GError
   flatpak_bwrap_envp_to_args (bwrap);
 
   if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
     return FALSE;
 
-  flatpak_bwrap_add_args (bwrap, command, NULL);
+  flatpak_bwrap_add_args (bwrap, "--", command, NULL);
+
   flatpak_bwrap_append_argsv (bwrap,
                               &argv[rest_argv_start + 2],
                               rest_argc - 2);
 
   g_ptr_array_add (bwrap->argv, NULL);
diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c
index 3a788469a4..089fb80734 100644
--- a/common/flatpak-dir.c
+++ b/common/flatpak-dir.c
@@ -7153,10 +7153,11 @@ flatpak_dir_run_triggers (FlatpakDir   *self,
                                   "--unshare-pid",
                                   "--ro-bind", "/", "/",
                                   "--proc", "/proc",
                                   "--dev", "/dev",
                                   "--bind", basedir, basedir,
+                                  "--",
                                   NULL);
 #endif
           flatpak_bwrap_add_args (bwrap,
                                   flatpak_file_get_path_cached (child),
                                   basedir,
diff --git a/common/flatpak-run-dbus.c b/common/flatpak-run-dbus.c
index 3074549bc9..bb64c15bf0 100644
--- a/common/flatpak-run-dbus.c
+++ b/common/flatpak-run-dbus.c
@@ -102,10 +102,13 @@ add_bwrap_wrapper (FlatpakBwrap *bwrap,
   flatpak_bwrap_add_args_data_fd (bwrap, "--file", g_steal_fd (&app_info_fd), "/.flatpak-info");
 
   if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
     return FALSE;
 
+  /* End of options: the next argument will be the executable name */
+  flatpak_bwrap_add_arg (bwrap, "--");
+
   return TRUE;
 }
 
 gboolean
 flatpak_run_maybe_start_dbus_proxy (FlatpakBwrap *app_bwrap,
diff --git a/common/flatpak-run.c b/common/flatpak-run.c
index bd68b4806f..29fe563f36 100644
--- a/common/flatpak-run.c
+++ b/common/flatpak-run.c
@@ -3423,11 +3423,11 @@ flatpak_run_app (FlatpakDecomposed   *app_ref,
   flatpak_bwrap_envp_to_args (bwrap);
 
   if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
     return FALSE;
 
-  flatpak_bwrap_add_arg (bwrap, command);
+  flatpak_bwrap_add_args (bwrap, "--", command, NULL);
 
   if (!add_rest_args (bwrap, app_id,
                       exports, (flags & FLATPAK_RUN_FLAG_FILE_FORWARDING) != 0,
                       doc_mount_path,
                       args, n_args, error))

Vulnerable code:   flatpak_bwrap_add_args (bwrap, command, NULL);
  flatpak_bwrap_add_arg (bwrap, command);
Fixed code:   flatpak_bwrap_add_args (bwrap, "--", command, NULL);

                                  "--",
  /* End of options: the next argument will be the executable name */
  flatpak_bwrap_add_arg (bwrap, "--");

  flatpak_bwrap_add_args (bwrap, "--", command, NULL);