Input validation error in Flatpak - CVE-2023-28100

Vulnerability identifier: #VU73835

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-28100

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a malicious application to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input when handling copy/paste operations. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited.

Flatpak
Oracle Linux
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for IBM z Systems
Anolis OS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Desktop Applications Module
openSUSE Leap
openEuler
Fedora
flatpak-zsh-completion
libflatpak0-debuginfo
flatpak
typelib-1_0-Flatpak-1_0
flatpak-debugsource
flatpak-debuginfo
flatpak-devel
libflatpak0
flatpak-help
flatpak (Red Hat package)
flatpak-selinux
flatpak-session-helper
flatpak-libs
system-user-flatpak
sys-apps/flatpak
Red Hat Migration Toolkit for Applications

Install updates from vendor's website.

Flatpak - addressed in versions 1.10.8, 1.12.8, 1.14.4, 1.15.4
flatpak-zsh-completion - addressed in versions 1.2.3-150100.4.11.1, 1.10.8-150200.4.15.1, 1.12.8-150400.3.3.1
libflatpak0-debuginfo - addressed in versions 1.2.3-150100.4.11.1, 1.4.2-3.3.1, 1.10.8-150200.4.15.1, 1.12.8-150400.3.3.1
flatpak - addressed in versions 1.2.3-150100.4.11.1, 1.4.2-3.3.1, 1.10.8-150200.4.15.1, 1.12.8-150400.3.3.1
typelib-1_0-Flatpak-1_0 - addressed in versions 1.2.3-150100.4.11.1, 1.4.2-3.3.1, 1.10.8-150200.4.15.1, 1.12.8-150400.3.3.1
flatpak-debugsource - addressed in versions 1.2.3-150100.4.11.1, 1.4.2-3.3.1, 1.10.8-150200.4.15.1, 1.12.8-150400.3.3.1
flatpak-debuginfo - addressed in versions 1.2.3-150100.4.11.1, 1.4.2-3.3.1, 1.10.8-150200.4.15.1, 1.12.8-150400.3.3.1
flatpak-devel - addressed in versions 1.2.3-150100.4.11.1, 1.10.8-150200.4.15.1, 1.12.8-150400.3.3.1
libflatpak0 - addressed in versions 1.2.3-150100.4.11.1, 1.4.2-3.3.1, 1.10.8-150200.4.15.1, 1.12.8-150400.3.3.1
flatpak - update to 1.10.2-7
flatpak-debuginfo - update to 1.10.2-7
flatpak-devel - update to 1.10.2-7
flatpak-help - update to 1.10.2-7
flatpak-debugsource - update to 1.10.2-7
flatpak (Red Hat package) - addressed in versions 1.10.8-1.el8, 1.12.8-1.el9
flatpak-selinux - update to 1.10.8-1.0.1
flatpak-session-helper - update to 1.10.8-1.0.1
flatpak-libs - update to 1.10.8-1.0.1
flatpak-devel - update to 1.10.8-1.0.1
flatpak - update to 1.10.8-1.0.1
system-user-flatpak - addressed in versions 1.10.8-150200.4.15.1, 1.12.8-150400.3.3.1
flatpak - addressed in versions 1.12.8-1.fc36, 1.14.4-1.fc37, 1.15.4-1.fc38
sys-apps/flatpak - update to 1.14.4
Red Hat Migration Toolkit for Applications - update to 6.2

• https://github.com/flatpak/flatpak/security/advisories/GHSA-7qpw-3vjv-xrqp
• https://github.com/flatpak/flatpak/commit/8e63de9a7d3124f91140fc74f8ca9ed73ed53be9
• https://marc.info/?l=oss-security&m=167879021709955&w=2

• Multiple vulnerabilities in flatpak
• SUSE update for flatpak
• SUSE update for flatpak
• SUSE update for flatpak
• SUSE update for flatpak
• Fedora 38 update for flatpak
• Fedora 37 update for flatpak
• Fedora 36 update for flatpak
• Red Hat Enterprise Linux 9 update for flatpak
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8 update for flatpak
• Gentoo update for Flatpak
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• openEuler 22.03 LTS SP3 update for flatpak
• openEuler 22.03 LTS update for flatpak
• openEuler 22.03 LTS SP1 update for flatpak
• openEuler 22.03 LTS SP2 update for flatpak
• Anolis OS update for flatpak