Bug 1675070 (CVE-2019-8308)

Summary:	CVE-2019-8308 flatpak: potential /proc based sandbox escape
Product:	[Other] Security Response	Reporter:	Scott Gayou <sgayou>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amigadave, dking
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	flatpak 1.2.3, flatpak 1.0.7	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in flatpak. In certain special cases, installing flatpak applications and runtimes system-wide may allow an attacker to escape the flatpak sandbox. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:47:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1675432, 1675433, 1675435, 1675776
Bug Blocks:	1674941

Description Scott Gayou 2019-02-11 18:50:37 UTC

A flaw was discovered that may allow an attacker to escape from the flatpak sandbox via /proc/self/exe.

Upstream Commit: 
https://github.com/flatpak/flatpak/commit/cd2142888fc4c199723a0dfca1f15ea8788a5483

Comment 2 Scott Gayou 2019-02-11 20:57:18 UTC

Created flatpak tracking bugs for this issue:

Affects: fedora-all [bug 1675432]

Comment 5 Scott Gayou 2019-02-12 19:50:50 UTC

My current understanding is that the only portion of flatpak that should run as root is the system-helper. The system-helper functionality may call into apply_extra_data(), which eventually calls flatpak_run_setup_base_argv. The patch adds a new flag, FLATPAK_RUN_FLAG_NO_PROC, to ensure that proc isn't reachable during this operation.

From the devs (paraphrasing) -- this (running as root) should only happen during installation to a system-wide repository. Thus, users running an app or installing into a user repository should be not be impacted by this flaw as those specific operations should not occur as root.

Comment 6 Scott Gayou 2019-02-12 21:07:19 UTC

Looks like the potential callflow for the vulnerability is handle-deploy signal (unsure who actually raises this signal) inside of flatpack_system_helper.c -> flatpak_dir_deploy_install -> flatpak_dir_deploy -> apply_extra_data -> flatpak_run_setup_base_argv. The patch adds the  FLATPAK_RUN_FLAG_NO_PROC flag to this call.

flatpak_run_setup_base_argv also seems to be called in flatpak_run_app without the flag explicitly set. It looks like this instance could be executed via flatpak_installation_launch_full, but system-helper doesn't appear to call into that.

The question is if system-helper can ever trigger flatpak_run_app as root without that flag set, and, after a quick look, I don't think it can.

Comment 8 Scott Gayou 2019-02-13 16:06:29 UTC

Looks like Debian got CVE-2019-8308 assigned: https://github.com/flatpak/flatpak/issues/2699

Comment 9 Scott Gayou 2019-02-13 16:11:10 UTC

Statement:

This flaw appears to impact systems in special cases involving installing flatpak applications and runtimes system-wide. Installation of flatpak applications and runtimes locally should not be impacted.

Comment 11 errata-xmlrpc 2019-02-19 17:41:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:0375 https://access.redhat.com/errata/RHSA-2019:0375