REDHAT-BUG-2539419: Buffer Overflow
GHSA-jr92-2v97-wgvc (https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc)
Description: The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems). The silent truncation causes undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. On 64-bit systems, gsize and guint64 are the same width, so the truncation does not occur and the issue is not practically exploitable.
Mitigation: Only install applications from trusted OCI registries. Flatpak remotes using the default OSTree transport are not affected. Fixed in 1.18.1 (backports available for 1.16.x). Reported by @swick.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flatpakto a version that resolves this vulnerability.Fixed in 1.18.1Patch GHSA-jr92-2v97-wgvc - Compensating control
Only install applications from trusted OCI registries.
Event History
Frequently Asked Questions
Which systems and Flatpak configurations are exposed?
The issue is practically exploitable on 32-bit systems because gsize is 32 bits there. It affects OCI delta stream parsing; Flatpak remotes using the default OSTree transport are not affected, and 64-bit systems do not experience the truncation.
What does an attacker need to exploit this?
An attacker would need to provide a malicious OCI delta stream through an OCI registry that the affected system installs applications from. The malformed size values can cause an undersized allocation followed by a heap buffer overflow on 32-bit systems.
What can be done if an update cannot be applied immediately?
Only install applications from trusted OCI registries. Avoid installing from untrusted OCI registries until the affected Flatpak version is updated.
Which fixed versions are identified?
The issue is fixed in Flatpak 1.18.1. Backports are available for the 1.16.x series.