Bug 2543196

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

GHSA-f3p8-vr7v-gxf2 (https://github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2)

Description: If a sandboxed app calls kill(0, signal) or killpg(0, signal), process ID namespace separation does not prevent the signal from being received by every process in the current process group, even though some of those processes are outside the process ID namespace. A malicious or compromised Flatpak app can cause denial of service by terminating processes outside its sandbox. For example, when running under GNOME Shell, the Flatpak app can terminate the shell, causing the desktop session to end. If processes in the same process group take an unsafe action on receiving a signal (e.g. SIGUSR1 puts them into a mode that exposes additional attack surface), a malicious or compromised app could trigger this.

Mitigation: Run Flatpak apps in a new session (setsid flatpak run ...) or a new process group (setpgid(0, 0) in the parent), or avoid running untrusted Flatpak apps. Patched in 1.18.4 by commit a3cf27b5 ("common: Put each bubblewrap child process in its own process group"). Credit: Reported by Guthrie Armstrong, Coalition, Inc.