CVE-2023-28100: Insufficient Information (NVD-CWE-noinfo)
value: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be used in a Wayland or X11 graphical environment.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.5
Published: 2023-03-16T16:15Z
Repository: https://github.com/flatpak/flatpak
Language: C
Files changed: common/flatpak-run.c, tests/test-seccomp.sh, tests/try-syscall.c
Commit date: 2023-03-16 09:54:14 +0000
Commit message: run: Prevent TIOCLINUX ioctl, the same as TIOCSTI

The TIOCLINUX ioctl is only available on Linux virtual consoles such as
/dev/tty1. It has several Linux-specific functions, one of which is a
copy/paste operation which can be used for attacks similar to TIOCSTI.

This vulnerability does not affect typical graphical terminal emulators
such as xterm, gnome-terminal and Konsole, and Flatpak is primarily
designed to be run from a Wayland or X11 graphical environment, so this
is relatively unlikely to be a practical problem.

CVE-2023-28100, GHSA-7qpw-3vjv-xrqp

Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-7qpw-3vjv-xrqp
Signed-off-by: Simon McVittie <smcv@debian.org>

Diff: diff --git a/common/flatpak-run.c b/common/flatpak-run.c
index 9a5195ab65..f871fb04d0 100644
--- a/common/flatpak-run.c
+++ b/common/flatpak-run.c
@@ -3218,10 +3218,14 @@ setup_seccomp (FlatpakBwrap   *bwrap,
     {SCMP_SYS (clone), EPERM, &SCMP_A0 (SCMP_CMP_MASKED_EQ, CLONE_NEWUSER, CLONE_NEWUSER)},
 #endif
 
     /* Don't allow faking input to the controlling tty (CVE-2017-5226) */
     {SCMP_SYS (ioctl), EPERM, &SCMP_A1 (SCMP_CMP_MASKED_EQ, 0xFFFFFFFFu, (int) TIOCSTI)},
+    /* In the unlikely event that the controlling tty is a Linux virtual
+     * console (/dev/tty2 or similar), copy/paste operations have an effect
+     * similar to TIOCSTI (CVE-2023-28100) */
+    {SCMP_SYS (ioctl), EPERM, &SCMP_A1 (SCMP_CMP_MASKED_EQ, 0xFFFFFFFFu, (int) TIOCLINUX)},
 
     /* seccomp can't look into clone3()'s struct clone_args to check whether
      * the flags are OK, so we have no choice but to block clone3().
      * Return ENOSYS so user-space will fall back to clone().
      * (GHSA-67h7-w3jq-vh4q; see also https://github.com/moby/moby/commit/9f6b562d) */
diff --git a/tests/test-seccomp.sh b/tests/test-seccomp.sh
index 72b0dad231..be6fb085d0 100755
--- a/tests/test-seccomp.sh
+++ b/tests/test-seccomp.sh
@@ -6,11 +6,11 @@ set -euo pipefail
 
 . $(dirname $0)/libtest.sh
 
 skip_without_bwrap
 
-echo "1..16"
+echo "1..18"
 
 setup_repo
 install_repo
 
 cp -a "$G_TEST_BUILDDIR/try-syscall" "$test_tmpdir/try-syscall"
@@ -78,10 +78,16 @@ for extra_argv in "" "--allow=multiarch"; do
   else
     assert_streq "$e" "$EPERM"
     ok "ioctl TIOCSTI with high bits blocked (CVE-2019-10063)"
   fi
 
+  echo "# ioctl TIOCLINUX (CVE-2023-28100)"
+  e=0
+  try_syscall "ioctl TIOCLINUX" || e="$?"
+  assert_streq "$e" "$EPERM"
+  ok "ioctl TIOCLINUX blocked"
+
   echo "# listen (benign)"
   e=0
   try_syscall "listen" || e="$?"
   assert_streq "$e" "$EBADF"
   ok "listen not blocked"
diff --git a/tests/try-syscall.c b/tests/try-syscall.c
index 221fe324bf..1a12ddee91 100644
--- a/tests/try-syscall.c
+++ b/tests/try-syscall.c
@@ -149,10 +149,19 @@ main (int argc, char **argv)
               errsv = errno;
               perror (arg);
             }
         }
 #endif
+      else if (strcmp (arg, "ioctl TIOCLINUX") == 0)
+        {
+          /* If not blocked by seccomp, this will fail with EBADF */
+          if (ioctl (-1, TIOCLINUX, WRONG_POINTER) != 0)
+            {
+              errsv = errno;
+              perror (arg);
+            }
+        }
      else if (strcmp (arg, "listen") == 0)
         {
           /* If not blocked by seccomp, this will fail with EBADF */
           if (listen (-1, 42) != 0)
             {

Vulnerable code: echo "1..16"
Fixed code:     /* In the unlikely event that the controlling tty is a Linux virtual
     * console (/dev/tty2 or similar), copy/paste operations have an effect
     * similar to TIOCSTI (CVE-2023-28100) */
    {SCMP_SYS (ioctl), EPERM, &SCMP_A1 (SCMP_CMP_MASKED_EQ, 0xFFFFFFFFu, (int) TIOCLINUX)},
echo "1..18"
  echo "# ioctl TIOCLINUX (CVE-2023-28100)"
  e=0
  try_syscall "ioctl TIOCLINUX" || e="$?"
  assert_streq "$e" "$EPERM"
  ok "ioctl TIOCLINUX blocked"

      else if (strcmp (arg, "ioctl TIOCLINUX") == 0)
        {
          /* If not blocked by seccomp, this will fail with EBADF */
          if (ioctl (-1, TIOCLINUX, WRONG_POINTER) != 0)
            {
              errsv = errno;
              perror (arg);
            }
        }