Bug 2535858

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

AI_ONLY_REPORT
package: flatpak-builder-1.4.4-1.el10
------
Summary: Host code execution via `git am` hook execution in patch source  
extraction (`use-git-am`): a crafted manifest can plant a Git hook in the  
shared extraction directory and have `git am` execute it in the host build  
context during patch application, before application sandboxing applies.
Requirements to exploit: A victim must run `flatpak-builder` on  
attacker-controlled manifest content that reaches a `patch` source with  
`use-git-am: true`. An earlier source in the same module must be able to  
create a Git repository in the shared extraction directory and place an  
executable hook under `.git/hooks`. Exposure is reduced when builds are  
confined to disposable or strongly isolated workers.
Component affected: `flatpak-builder-1.4.4-1.el10`: source extraction in  
`src/builder-source-patch.c` (`patch()` /  
`builder_source_patch_extract()`), together with ordered source extraction  
in `src/builder-module.c` (`builder_module_extract_sources()`)
Version affected: `flatpak-builder-1.4.4-1.el10`
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Private maintainer notification.
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - 7.8 (HIGH)
AV:L - Exploitation requires a local build of attacker-supplied manifest  
content.
AC:L - Once `use-git-am: true` is used, the exploit only needs  
predictable source ordering and an executable hook in `.git/hooks`.
PR:N - The attacker does not need prior access to the build host;  
supplying the malicious manifest and sources is sufficient.
UI:R - A victim must start the build of the malicious manifest.
S:U - The resulting commands run in the same security scope as the  
`flatpak-builder` process, as the build user.
C:H - Executed commands can read data available to the build user.
I:H - Executed commands can modify build outputs and other files  
available to the build user.
A:H - Executed commands can disrupt the build environment or delete  
accessible data.
Impact: Important. Successful exploitation can execute arbitrary commands  
in the host build context of the user running `flatpak-builder`, directly  
affecting confidentiality, integrity, and availability of that user's  
resources. This is not Critical because exploitation is local, requires  
user interaction, and depends on the `use-git-am` path.
Embargo: yes
Reason: The issue provides a clear, reproducible route to host-side  
command execution during source extraction. Although exploitation requires  
a user to build attacker-supplied content, private coordination gives  
maintainers time to ship a fix before detailed reproduction guidance  
becomes public.
Acknowledgement: Aisle Research
Vulnerability Details: When `use-git-am` is enabled, the patch extraction  
helper builds a `git am` command and executes it through `flatpak_spawnv()`  
in the extraction directory without disabling Git hooks:
```c
static gboolean
patch (GFile      *dir,
gboolean    use_git,
gboolean    use_git_am,
const char *patch_path,
char      **extra_options,
GError    **error,
...)
{
gboolean res;
GPtrArray *args;
const gchar *arg;
va_list ap;
int i;
va_start(ap, error);
args = g_ptr_array_new ();
if (use_git) {
g_ptr_array_add (args, "git");
g_ptr_array_add (args, "apply");
g_ptr_array_add (args, "-v");
} else if (use_git_am) {
g_ptr_array_add (args, "git");
g_ptr_array_add (args, "am");
g_ptr_array_add (args, "--keep-cr");
} else {
g_ptr_array_add (args, "patch");
}
...
res = flatpak_spawnv (dir, NULL, 0, error, (const char **) args->pdata,  
NULL);
```
Sources for a module are then extracted sequentially into the same  
destination directory:
```c
for (l = self->sources; l != NULL; l = l->next)
{
BuilderSource *source = l->data;
if (!builder_source_is_enabled (source, context))
continue;
if (!builder_source_extract (source, dest, self->build_options,  
context, error))
{
g_prefix_error (error, "module %s: ", self->name);
return FALSE;
}
}
```
This combination allows an attacker-controlled earlier source to prepare  
`.git/hooks/post-applypatch` in the shared extraction tree, and a later  
`patch` source with `use-git-am: true` can then cause that hook to run in  
the host build environment. The impact established by the available  
evidence is command execution as the build user, not demonstrated privilege  
escalation beyond that context. The behavior is consistent with CWE-94.
Steps to reproduce:
1. Prepare a local source tree such as `poc-src/` containing any normal  
file and an executable `.git/hooks/post-applypatch` that performs a visible  
action, for example writing `HOOK_RAN` to `/tmp/flatpak-builder-hook-ran`.
2. Prepare a valid mbox patch that can be applied by `git am`.
3. Use a manifest whose sources are ordered so that an earlier source  
creates a Git repository in the extraction directory, for example an  
`archive` source with `git-init: true`, followed by a `dir` source pointing  
to `poc-src`, followed by a `patch` source with `use-git-am: true`.
4. Run `flatpak-builder <build-dir> <manifest.json>`.
5. Observe that `/tmp/flatpak-builder-hook-ran` is created in the  
host/build environment after the patch step runs.
Mitigation: Until a fixed package is available, avoid `use-git-am: true`  
when processing untrusted manifests or source material. If untrusted  
manifests must be built, run them only inside disposable VMs or  
equivalently strong isolation so that any unintended hook execution is  
contained to the worker.
Proposed Fix: Disable Git hook discovery for internal `git` invocations  
used during patch extraction by setting `core.hooksPath=/dev/null`.
```diff
diff --git a/src/builder-source-patch.c b/src/builder-source-patch.c
index 0000000..0000000 100644
— a/src/builder-source-patch.c
+++ b/src/builder-source-patch.c
@@ -249,12 +249,16 @@ patch (GFile      *dir,
args = g_ptr_array_new ();
if (use_git) {
g_ptr_array_add (args, "git");
+    g_ptr_array_add (args, "-c");
+    g_ptr_array_add (args, "core.hooksPath=/dev/null");
g_ptr_array_add (args, "apply");
g_ptr_array_add (args, "-v");
} else if (use_git_am) {
g_ptr_array_add (args, "git");
+    g_ptr_array_add (args, "-c");
+    g_ptr_array_add (args, "core.hooksPath=/dev/null");
g_ptr_array_add (args, "am");
   g_ptr_array_add (args, "--keep-cr");
+    g_ptr_array_add (args, "--keep-cr");
    } else {
      g_ptr_array_add (args, "patch");
    }
```


------
This report was generated using AI technology. Always review AI-generated  
content prior to use