bubblewrap-0.4.0-2.el8_10, flatpak-1.12.9-3.el8_10
エラータID: AXSA:2024-8785:01
リリース日:
2024/09/06 Friday - 14:59
題名:
bubblewrap-0.4.0-2.el8_10, flatpak-1.12.9-3.el8_10
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Flatpak には、persistent=subdir オプションが指定されて
いる場合、パーシステントディレクトリをマウントする際、
本来アクセスが許容されていないファイルへのアクセスを
許容してしまう問題があるため、リモートの攻撃者により、
細工されたシンボリックリンクを介して、データ破壊、
および情報の漏洩を可能とする脆弱性が存在します。
(CVE-2024-42472)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2024-42472
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality. When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access. However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code. For the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson "wrap" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality. When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access. However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code. For the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson "wrap" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.
追加情報:
N/A
ダウンロード:
SRPMS
- bubblewrap-0.4.0-2.el8_10.src.rpm
MD5: c4d2a2d49e4e5388196388b087bbe382
SHA-256: aa146a62322a4f44618046b40ce2decf7adab59d76114523b9b837507766ea0f
Size: 222.36 kB - flatpak-1.12.9-3.el8_10.src.rpm
MD5: 70a2fbc9c75a7fbb0cc32fe2d39e1f50
SHA-256: 93a3fcd64fe7641f0e41c0f289495636ab599c8b8f6d9c0224cb6e1d523d498c
Size: 1.53 MB
Asianux Server 8 for x86_64
- bubblewrap-0.4.0-2.el8_10.x86_64.rpm
MD5: 4bcbd77bba4557c12e976fe25bb983c2
SHA-256: ef6a382c72a9a05bd79910d767e107197c5cc48df07111839f9af2cde5cc4160
Size: 49.73 kB - flatpak-1.12.9-3.el8_10.i686.rpm
MD5: 82029f2ec3073250e4f024a321ff358d
SHA-256: affbb5be94586542ba6f7134483688d4af05a9e3d6a72de4bb10ef8be5f74e73
Size: 1.81 MB - flatpak-1.12.9-3.el8_10.x86_64.rpm
MD5: 2282e28ab1d21cc4ccfcf845cf9d59e2
SHA-256: 8d8ddec8b39981d76ac7a4cb6e261eaf42a77c176c0232c30ae37a3c45ef51c3
Size: 1.77 MB - flatpak-devel-1.12.9-3.el8_10.i686.rpm
MD5: e9f713a17b3e1d15b44fde68df3aeb14
SHA-256: 8d7075512e104a6ed48714d9396b2382971ead793baaaa16f63248e5aff0e423
Size: 117.47 kB - flatpak-devel-1.12.9-3.el8_10.x86_64.rpm
MD5: 7260cd278ca78da5db68ffed76270a1b
SHA-256: ebaa4e189d31480bc4ffcb16fc5140cb6cc79bb487136941aa72b110248c6399
Size: 117.45 kB - flatpak-libs-1.12.9-3.el8_10.i686.rpm
MD5: c301eccd697fa6cd1b00f03ffd9865d8
SHA-256: d661b239b75e5f3d1651e349ff61f0f163c931e6fd56990549e0fd23cc3bdea1
Size: 532.73 kB - flatpak-libs-1.12.9-3.el8_10.x86_64.rpm
MD5: 6f2fefa9ace67209a5bc8b12119f1df8
SHA-256: 3902fa3646db75507cb0d2fcae08bc2116210cde0aeb9b125ce812eed61cb3bc
Size: 513.14 kB - flatpak-selinux-1.12.9-3.el8_10.noarch.rpm
MD5: 8e25a8e8dd14c0b144befe50991ca4e6
SHA-256: c47208eeb390c76d949b8ea8cacd197fea3efddc5a96b4d6f771b658ccee47cc
Size: 27.25 kB - flatpak-session-helper-1.12.9-3.el8_10.i686.rpm
MD5: 7fe968f705026c998b7a160346f30e5a
SHA-256: e1bc48f94fdc7b97e416a879f6e56acfe42b275e5b0c71472e6a58d8bd5f36c3
Size: 78.97 kB - flatpak-session-helper-1.12.9-3.el8_10.x86_64.rpm
MD5: bdbb8e992b8d6ebfab4639f41bfcf193
SHA-256: eb4190767aceb590d4165ac1a8405b088f5a09d8edbdaef27d53fa3baf7d5f30
Size: 77.43 kB