REDHAT-BUG-2542698: Medium severity Flatpak Flatpak vulnerability
GHSA-f3p8-vr7v-gxf2 (https://github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2)
Description: If a sandboxed app calls kill(0, signal) or killpg(0, signal), process ID namespace separation does not prevent the signal from being received by every process in the current process group, even though some of those processes are outside the process ID namespace. A malicious or compromised Flatpak app can cause denial of service by terminating processes outside its sandbox. For example, when running under GNOME Shell, the Flatpak app can terminate the shell, causing the desktop session to end. If processes in the same process group take an unsafe action on receiving a signal (e.g. SIGUSR1 puts them into a mode that exposes additional attack surface), a malicious or compromised app could trigger this.
Mitigation: Run Flatpak apps in a new session (setsid flatpak run ...) or a new process group (setpgid(0, 0) in the parent), or avoid running untrusted Flatpak apps. Patched in 1.18.4 by commit a3cf27b5 ("common: Put each bubblewrap child process in its own process group"). Credit: Reported by Guthrie Armstrong, Coalition, Inc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.18.4Patch a3cf27b5 - Compensating control
Run Flatpak apps in a new session using `setsid flatpak run ...` or in a new process group using `setpgid(0, 0)` in the parent; alternatively, avoid running untrusted Flatpak apps.
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious or compromised sandboxed Flatpak app can exploit it by calling kill(0, signal) or killpg(0, signal). The impact depends on processes outside the sandbox sharing the app's current process group.
What is the practical impact on a desktop system?
An affected Flatpak app can cause denial of service by signaling and potentially terminating processes outside its sandbox. When run under GNOME Shell, it can terminate the shell and end the desktop session; other signals might trigger unsafe behavior in receiving processes.
What can be done if patching is not immediately possible?
Run Flatpak apps in a new session using setsid flatpak run, or place them in a new process group with setpgid(0, 0) in the parent process. Avoid running untrusted Flatpak apps until the issue is addressed.
What version includes the fix?
The issue is patched in Flatpak 1.18.4. The fix places each bubblewrap child process in its own process group.