Important: bubblewrap and flatpak security update
Summary
ALSA-2024:6356: Important: bubblewrap and flatpak security update. Affects bubblewrap versions < 0.4.1-7.el9_4.alma.1. Fixed in 0.4.1-7.el9_4.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. It is used to create and manage sandboxed environments for running applications securely. Flatpak is a software deployment and package management system that utilizes bubblewrap to provide sandboxing capabilities for applications. It allows users to install and run applications in isolated environments, reducing the risk of security vulnerabilities.
Vulnerability Detail
The vulnerability (CVE-2024-42472) in flatpak allows apps using the persistent flag (--persist) to access files outside the sandbox. This means that an attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive files on the host system. The impact of this vulnerability can vary depending on the permissions and privileges of the affected application.
How To Fix
Minimum fixed version
0.4.1-7.el9_4.alma.1
This is the first release that contains the fix.
sudo dnf update bubblewrapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted applications are granted access to sensitive files and directories. Additionally, regular monitoring and auditing of file system access can help detect any unauthorized access attempts.
Conclusion
In conclusion, it is important to update the bubblewrap and flatpak packages to the fixed versions to address the vulnerability. This will help ensure the security of applications running in sandboxed environments and prevent unauthorized access to sensitive files.
See every vulnerability recorded for bubblewrap →
FAQ
Bubblewrap is a core execution engine for unprivileged containers that provides sandboxing capabilities for running applications securely.
Flatpak is a software deployment and package management system that utilizes bubblewrap to provide sandboxing capabilities for applications.
The impact of this vulnerability can vary depending on the permissions and privileges of the affected application. An attacker could potentially gain unauthorized access to sensitive files on the host system.
To fix this vulnerability, update the affected packages to the fixed versions provided by the package maintainers.
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted applications are granted access to sensitive files and directories.
Related vulnerabilities
Recent vulnerabilities recorded for bubblewrap.
