CVE-2023-28100 (published 2023-03-16T16:15Z)

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be used in a Wayland or X11 graphical environment.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/flatpak/flatpak
commit_details: repo_url: https://github.com/flatpak/flatpak
author: Simon McVittie
author_date: 2023-03-15 09:58:56+00:00
msg: run: Prevent TIOCLINUX ioctl, the same as TIOCSTI

The TIOCLINUX ioctl is only available on Linux virtual consoles such as
/dev/tty1. It has several Linux-specific functions, one of which is a
copy/paste operation which can be used for attacks similar to TIOCSTI.

This vulnerability does not affect typical graphical terminal emulators
such as xterm, gnome-terminal and Konsole, and Flatpak is primarily
designed to be run from a Wayland or X11 graphical environment, so this
is relatively unlikely to be a practical problem.

CVE-2023-28100, GHSA-7qpw-3vjv-xrqp

Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-7qpw-3vjv-xrqp
Signed-off-by: Simon McVittie <smcv@debian.org>
repository: repo_url: https://github.com/flatpak/flatpak
repo_name: flatpak/flatpak
description: Linux application sandboxing and distribution framework
repo_language: C
owner: flatpak
file_changes: filename: flatpak-run.c
change_type: ModificationType.MODIFY
diff: @@ -3220,6 +3220,10 @@ setup_seccomp (FlatpakBwrap   *bwrap,
 
     /* Don't allow faking input to the controlling tty (CVE-2017-5226) */
     {SCMP_SYS (ioctl), EPERM, &SCMP_A1 (SCMP_CMP_MASKED_EQ, 0xFFFFFFFFu, (int) TIOCSTI)},
+    /* In the unlikely event that the controlling tty is a Linux virtual
+     * console (/dev/tty2 or similar), copy/paste operations have an effect
+     * similar to TIOCSTI (CVE-2023-28100) */
+    {SCMP_SYS (ioctl), EPERM, &SCMP_A1 (SCMP_CMP_MASKED_EQ, 0xFFFFFFFFu, (int) TIOCLINUX)},
 
     /* seccomp can't look into clone3()'s struct clone_args to check whether
      * the flags are OK, so we have no choice but to block clone3().

programming_language: C
filename: test-seccomp.sh
change_type: ModificationType.MODIFY
diff: @@ -8,7 +8,7 @@ set -euo pipefail
 
 skip_without_bwrap
 
-echo "1..16"
+echo "1..18"
 
 setup_repo
 install_repo
@@ -80,6 +80,12 @@ for extra_argv in "" "--allow=multiarch"; do
     ok "ioctl TIOCSTI with high bits blocked (CVE-2019-10063)"
   fi
 
+  echo "# ioctl TIOCLINUX (CVE-2023-28100)"
+  e=0
+  try_syscall "ioctl TIOCLINUX" || e="$?"
+  assert_streq "$e" "$EPERM"
+  ok "ioctl TIOCLINUX blocked"
+
   echo "# listen (benign)"
   e=0
   try_syscall "listen" || e="$?"

programming_language: Shell
filename: try-syscall.c
change_type: ModificationType.MODIFY
diff: @@ -151,6 +151,15 @@ main (int argc, char **argv)
             }
         }
 #endif
+      else if (strcmp (arg, "ioctl TIOCLINUX") == 0)
+        {
+          /* If not blocked by seccomp, this will fail with EBADF */
+          if (ioctl (-1, TIOCLINUX, WRONG_POINTER) != 0)
+            {
+              errsv = errno;
+              perror (arg);
+            }
+        }
      else if (strcmp (arg, "listen") == 0)
         {
           /* If not blocked by seccomp, this will fail with EBADF */

programming_language: C