Amazon Linux 2 Security Advisory: ALAS-2024-2712
Advisory Release Date: 2024-12-05 01:02 Pacific
Advisory Updated Date: 2024-12-19 16:00 Pacific
A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the designated sandbox. As a result, the attacker could potentially manipulate the file system, leading to unauthorized actions that compromise the security and integrity of the system.
Flatpak is not providing a security boundary that protects the OS from untrusted content in the flatpak. Flatpak applications should be vetted and reviewed with the same attention as regular OS packages. It should be assumed that an installed flatpak shares the same privileges and access than the user running it. (CVE-2024-42472)
Affected Packages:
flatpak
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update flatpak to update your system.
aarch64:
flatpak-1.0.9-10.amzn2.0.6.aarch64
flatpak-builder-1.0.0-10.amzn2.0.6.aarch64
flatpak-devel-1.0.9-10.amzn2.0.6.aarch64
flatpak-libs-1.0.9-10.amzn2.0.6.aarch64
flatpak-debuginfo-1.0.9-10.amzn2.0.6.aarch64
i686:
flatpak-1.0.9-10.amzn2.0.6.i686
flatpak-builder-1.0.0-10.amzn2.0.6.i686
flatpak-devel-1.0.9-10.amzn2.0.6.i686
flatpak-libs-1.0.9-10.amzn2.0.6.i686
flatpak-debuginfo-1.0.9-10.amzn2.0.6.i686
src:
flatpak-1.0.9-10.amzn2.0.6.src
x86_64:
flatpak-1.0.9-10.amzn2.0.6.x86_64
flatpak-builder-1.0.0-10.amzn2.0.6.x86_64
flatpak-devel-1.0.9-10.amzn2.0.6.x86_64
flatpak-libs-1.0.9-10.amzn2.0.6.x86_64
flatpak-debuginfo-1.0.9-10.amzn2.0.6.x86_64