Link following in Flatpak - #VU141408

Vulnerability details

The vulnerability allows a local user to write files with fixed names and fixed content outside of the sandbox.

The vulnerability exists due to improper link resolution in regenerate_ld_cache when handling a symlinked ~/.var/app/$appid/.ld.so path. A local user can replace ~/.var/app/$appid/.ld.so with a symlink to write files with fixed names and fixed content outside of the sandbox.

The filenames and file content are not attacker-controlled, which makes exploitation difficult.

Affected software

Remediation

External References

• https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x
• https://github.com/flatpak/flatpak/commit/76c9296b6780ca67f44cf67f0823f086d692a592

Related Security Bulletins

• Multiple vulnerabilities in Flatpak