Vulnerability-Lookup

usn-7046-1

Vulnerability from osv_ubuntu

Published

2024-09-30 18:14

Modified

2026-04-27 14:11

Summary

bubblewrap, flatpak vulnerability

Details

It was discovered that Flatpak incorrectly handled certain persisted directories. An attacker could possibly use this issue to read and write files in locations it would not normally have access to. A patch was also needed to Bubblewrap in order to avoid race conditions caused by this fix.

References

URL

Type

	https://ubuntu.com/security/notices/USN-7046-1	ADVISORY
	https://ubuntu.com/security/CVE-2024-42472	REPORT
	https://launchpad.net/bugs/2077087	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-42472",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "bubblewrap",
            "binary_version": "0.4.0-1ubuntu4.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "bubblewrap",
        "purl": "pkg:deb/ubuntu/bubblewrap@0.4.0-1ubuntu4.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.0-1ubuntu4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.3.3-2",
        "0.4.0-1",
        "0.4.0-1ubuntu1",
        "0.4.0-1ubuntu2",
        "0.4.0-1ubuntu3",
        "0.4.0-1ubuntu4"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-42472",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "flatpak",
            "binary_version": "1.6.5-0ubuntu0.5"
          },
          {
            "binary_name": "flatpak-tests",
            "binary_version": "1.6.5-0ubuntu0.5"
          },
          {
            "binary_name": "gir1.2-flatpak-1.0",
            "binary_version": "1.6.5-0ubuntu0.5"
          },
          {
            "binary_name": "libflatpak0",
            "binary_version": "1.6.5-0ubuntu0.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "flatpak",
        "purl": "pkg:deb/ubuntu/flatpak@1.6.5-0ubuntu0.5?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.5-0ubuntu0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.3-1",
        "1.6.0-1",
        "1.6.1-1",
        "1.6.2-1",
        "1.6.3-1",
        "1.6.5-0ubuntu0.1",
        "1.6.5-0ubuntu0.2",
        "1.6.5-0ubuntu0.3",
        "1.6.5-0ubuntu0.4"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-42472",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "bubblewrap",
            "binary_version": "0.6.1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "bubblewrap",
        "purl": "pkg:deb/ubuntu/bubblewrap@0.6.1-1ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.1-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.4.1-3build1",
        "0.5.0-1",
        "0.6.0-1",
        "0.6.1-1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-42472",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "flatpak",
            "binary_version": "1.12.7-1ubuntu0.1"
          },
          {
            "binary_name": "flatpak-tests",
            "binary_version": "1.12.7-1ubuntu0.1"
          },
          {
            "binary_name": "gir1.2-flatpak-1.0",
            "binary_version": "1.12.7-1ubuntu0.1"
          },
          {
            "binary_name": "libflatpak0",
            "binary_version": "1.12.7-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "flatpak",
        "purl": "pkg:deb/ubuntu/flatpak@1.12.7-1ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.7-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.2-3",
        "1.12.2-1",
        "1.12.2-2",
        "1.12.3-1",
        "1.12.4-1",
        "1.12.5-1",
        "1.12.6-1",
        "1.12.7-1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-42472",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "bubblewrap",
            "binary_version": "0.9.0-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "bubblewrap",
        "purl": "pkg:deb/ubuntu/bubblewrap@0.9.0-1ubuntu0.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.8.0-2",
        "0.9.0-1build1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-42472",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "flatpak",
            "binary_version": "1.14.6-1ubuntu0.1"
          },
          {
            "binary_name": "flatpak-tests",
            "binary_version": "1.14.6-1ubuntu0.1"
          },
          {
            "binary_name": "gir1.2-flatpak-1.0",
            "binary_version": "1.14.6-1ubuntu0.1"
          },
          {
            "binary_name": "libflatpak0",
            "binary_version": "1.14.6-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "flatpak",
        "purl": "pkg:deb/ubuntu/flatpak@1.14.6-1ubuntu0.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.14.6-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.14.4-2",
        "1.14.5-1",
        "1.14.5-1build1",
        "1.14.5-1build4",
        "1.14.5-1build5",
        "1.14.5-1build6",
        "1.14.6-1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Flatpak incorrectly handled certain persisted\ndirectories. An attacker could possibly use this issue to read\nand write files in locations it would not normally have access to.\nA patch was also needed to Bubblewrap in order to avoid race\nconditions caused by this fix.\n",
  "id": "USN-7046-1",
  "modified": "2026-04-27T14:11:37Z",
  "published": "2024-09-30T18:14:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7046-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-42472"
    },
    {
      "type": "REPORT",
      "url": "https://launchpad.net/bugs/2077087"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "bubblewrap, flatpak vulnerability",
  "upstream": [
    "UBUNTU-CVE-2024-42472"
  ]
}

ubuntu-cve-2024-42472

Vulnerability from osv_ubuntu

Published

2024-08-15 19:15

Modified

2026-04-22 07:50

Summary

Details

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality. When persistent=subdir is used in the application permissions (represented as --persist=subdir in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory subdir. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as ~/.var/app/$APPID/subdir. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access. However, the application does have write access to the application directory ~/.var/app/$APPID where this directory is stored. If the source directory for the persistent/--persist option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new --bind-fd option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with -Dsystem_bubblewrap=bwrap (1.15.x) or --with-system-bubblewrap=bwrap (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically /usr/bin/bwrap. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with -Dsystem_bubblewrap= (1.15.x) or with --without-system-bubblewrap (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as /usr/libexec/flatpak-bwrap. This configuration is the default when building from source code. For the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson "wrap" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the persistent (--persist) permission.

Severity

10.0 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-42472	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-42472	REPORT
	https://github.com/flatpak/flatpak/releases/tag/1.14.10	REPORT
	https://github.com/flatpak/flatpak/security/advis…	REPORT
	https://ubuntu.com/security/notices/USN-7046-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "flatpak",
            "binary_version": "1.0.9-0ubuntu0.4"
          },
          {
            "binary_name": "flatpak-tests",
            "binary_version": "1.0.9-0ubuntu0.4"
          },
          {
            "binary_name": "gir1.2-flatpak-1.0",
            "binary_version": "1.0.9-0ubuntu0.4"
          },
          {
            "binary_name": "libflatpak0",
            "binary_version": "1.0.9-0ubuntu0.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "flatpak",
        "purl": "pkg:deb/ubuntu/flatpak@1.0.9-0ubuntu0.4?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.8.7-5",
        "0.10.0-1",
        "0.10.0-2",
        "0.10.1-1",
        "0.10.2-1",
        "0.10.2.1-1",
        "0.10.2.1-2",
        "0.10.3-1",
        "0.11.1-0ubuntu1",
        "0.11.3-2",
        "0.11.3-3",
        "0.11.7-0ubuntu0.1",
        "1.0.1-0ubuntu0.1",
        "1.0.6-0ubuntu0.1",
        "1.0.7-0ubuntu0.18.04.1",
        "1.0.8-0ubuntu0.18.04.1",
        "1.0.9-0ubuntu0.1",
        "1.0.9-0ubuntu0.2",
        "1.0.9-0ubuntu0.3",
        "1.0.9-0ubuntu0.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "flatpak",
            "binary_version": "1.6.5-0ubuntu0.5"
          },
          {
            "binary_name": "flatpak-tests",
            "binary_version": "1.6.5-0ubuntu0.5"
          },
          {
            "binary_name": "gir1.2-flatpak-1.0",
            "binary_version": "1.6.5-0ubuntu0.5"
          },
          {
            "binary_name": "libflatpak0",
            "binary_version": "1.6.5-0ubuntu0.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "flatpak",
        "purl": "pkg:deb/ubuntu/flatpak@1.6.5-0ubuntu0.5?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.5-0ubuntu0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.3-1",
        "1.6.0-1",
        "1.6.1-1",
        "1.6.2-1",
        "1.6.3-1",
        "1.6.5-0ubuntu0.1",
        "1.6.5-0ubuntu0.2",
        "1.6.5-0ubuntu0.3",
        "1.6.5-0ubuntu0.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "flatpak",
            "binary_version": "1.12.7-1ubuntu0.1"
          },
          {
            "binary_name": "flatpak-tests",
            "binary_version": "1.12.7-1ubuntu0.1"
          },
          {
            "binary_name": "gir1.2-flatpak-1.0",
            "binary_version": "1.12.7-1ubuntu0.1"
          },
          {
            "binary_name": "libflatpak0",
            "binary_version": "1.12.7-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "flatpak",
        "purl": "pkg:deb/ubuntu/flatpak@1.12.7-1ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.7-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.2-3",
        "1.12.2-1",
        "1.12.2-2",
        "1.12.3-1",
        "1.12.4-1",
        "1.12.5-1",
        "1.12.6-1",
        "1.12.7-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "flatpak",
            "binary_version": "1.14.6-1ubuntu0.1"
          },
          {
            "binary_name": "flatpak-tests",
            "binary_version": "1.14.6-1ubuntu0.1"
          },
          {
            "binary_name": "gir1.2-flatpak-1.0",
            "binary_version": "1.14.6-1ubuntu0.1"
          },
          {
            "binary_name": "libflatpak0",
            "binary_version": "1.14.6-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "flatpak",
        "purl": "pkg:deb/ubuntu/flatpak@1.14.6-1ubuntu0.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.14.6-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.14.4-2",
        "1.14.5-1",
        "1.14.5-1build1",
        "1.14.5-1build4",
        "1.14.5-1build5",
        "1.14.5-1build6",
        "1.14.6-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality. When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn\u0027t have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access. However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code. For the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson \"wrap\" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.",
  "id": "UBUNTU-CVE-2024-42472",
  "modified": "2026-04-22T07:50:16Z",
  "published": "2024-08-15T19:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-42472"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42472"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/flatpak/flatpak/releases/tag/1.14.10"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-7hgv-f2j8-xw87"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7046-1"
    }
  ],
  "related": [
    "USN-7046-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-42472"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

usn-7046-1

Vulnerability from osv_ubuntu

ubuntu-cve-2024-42472

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature