Amazon Linux 2023 Security Advisory: ALAS-2024-726
Advisory Release Date: 2024-10-10 03:02 Pacific
Advisory Updated Date: 2024-10-14 16:00 Pacific
A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the designated sandbox. As a result, the attacker could potentially manipulate the file system, leading to unauthorized actions that compromise the security and integrity of the system.
Flatpak is not providing a security boundary that protects the OS from untrusted content in the flatpak. Flatpak applications should be vetted and reviewed with the same attention as regular OS packages. It should be assumed that an installed flatpak shares the same privileges and access than the user running it. (CVE-2024-42472)
Affected Packages:
bubblewrap
Issue Correction:
Run dnf update bubblewrap --releasever 2023.6.20241010 to update your system.
aarch64:
bubblewrap-debuginfo-0.10.0-1.amzn2023.0.1.aarch64
bubblewrap-debugsource-0.10.0-1.amzn2023.0.1.aarch64
bubblewrap-0.10.0-1.amzn2023.0.1.aarch64
src:
bubblewrap-0.10.0-1.amzn2023.0.1.src
x86_64:
bubblewrap-debugsource-0.10.0-1.amzn2023.0.1.x86_64
bubblewrap-debuginfo-0.10.0-1.amzn2023.0.1.x86_64
bubblewrap-0.10.0-1.amzn2023.0.1.x86_64