Bug 1542207 (CVE-2018-6560)

Summary:	CVE-2018-6560 flatpak: sandbox escape in D-Bus filtering by a crafted authentication handshake
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amigadave, dking, jkoten
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	flatpak 0.8.9, flatpak 0.10.3	Doc Type:	If docs needed, set a value
Doc Text:	It was found that flatpak's D-Bus proxy did not properly filter the access to D-Bus during the authentication protocol. A specially crafted flatpak application could use this flaw to bypass all restrictions imposed by flatpak and have full access to the D-BUS interface.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:39:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1547003, 1547376, 1547377
Bug Blocks:	1542208

Description Laura Pardo 2018-02-05 20:21:19 UTC

A flaw was found in dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted. D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

References:
https://github.com/flatpak/flatpak/releases/tag/0.8.9
https://github.com/flatpak/flatpak/releases/tag/0.10.3

Patch:
https://github.com/flatpak/flatpak/commit/52346bf187b5a7f1c0fe9075b328b7ad6abe78f6

Comment 6 errata-xmlrpc 2018-09-25 19:07:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:2766 https://access.redhat.com/errata/RHSA-2018:2766