CVE-2024-42472

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the designated sandbox. As a result, the attacker could potentially manipulate the file system, leading to unauthorized actions that compromise the security and integrity of the system.

This vulnerability in Flatpak represents a significant severity issue due to its potential to undermine the core principles of application sandboxing, which are designed to isolate applications and protect the integrity and confidentiality of the system. By exploiting the persistent=subdir option, a malicious or compromised application can manipulate bind mounts via symlinks, thereby escaping the confines of its designated sandbox. This allows unauthorized access to the host filesystem, enabling the potential for unauthorized data manipulation, exfiltration, or system compromise. The risk is further exacerbated by the presence of a race condition, which can be exploited by running multiple instances of a malicious app concurrently.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.