REDHAT-BUG-2539416: High severity Flatpak Flatpak vulnerability
GHSA-fqx6-vh4p-42cg (https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg)
Impact: A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem. On system installs, the write happens as root.
Description: There are two vulnerabilities in extractextradata. It resolves files/extra inside the checked-out commit tree using GFile path operations, which follow symlinks. If the files entry in the OSTree commit is a symlink (e.g., files -> /tmp), the downloaded extra-data blobs are written at the symlink target instead. Additionally, extractextradata writes downloaded blobs to files/extra/<name> where <name> comes from xa.extra-data-sources in the commit metadata; gfilegetchild resolves .. components, so a name like ../metadata escapes the extra/ directory.
Fixed in 1.18.1 (backports available for 1.16.x). Found by @swick after investigating a report from AISLE in cooperation with Red Hat.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flatpakto a version that resolves this vulnerability.Fixed in 1.18.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that install or update applications from a malicious or compromised Flatpak repository are exposed. For system-wide installs, the unintended file write occurs with root privileges.
What does an attacker need to exploit it?
The attacker needs control of repository content, including an OSTree commit with a symlinked files entry or crafted xa.extra-data-sources metadata. They can use symlink traversal or ../ path components to cause extra-data blobs to be written outside the intended files/extra directory.
Which versions contain a fix?
The issue is fixed in Flatpak 1.18.1. Backports are available for the 1.16.x series.