CVE-2019-10063 : Security Advisory and Response

Flatpak versions prior to 1.0.8, 1.1.x, 1.2.x before 1.2.4, and 1.3.x before 1.3.1 have a vulnerability allowing sandbox bypass. The CVE-2017-5226 fix in Flatpak 0.8.1 onwards was incomplete, enabling a bypass on 64-bit platforms.

Understanding CVE-2019-10063

Flatpak versions before specified releases have a security flaw that could lead to sandbox bypass.

What is CVE-2019-10063?

Flatpak versions before 1.0.8, 1.1.x, 1.2.x before 1.2.4, and 1.3.x before 1.3.1 contain a vulnerability allowing the bypassing of the sandbox. The fix implemented in Flatpak 0.8.1 onwards to address CVE-2017-5226 was not fully effective, particularly on 64-bit platforms.

The Impact of CVE-2019-10063

The vulnerability in Flatpak versions could allow malicious actors to execute commands outside the sandbox after a sandboxed application terminates, posing a security risk to affected systems.

Technical Details of CVE-2019-10063

Flatpak vulnerability details and affected systems.

Vulnerability Description

Flatpak versions before specified releases allow bypassing the sandbox, potentially leading to unauthorized command execution.

Affected Systems and Versions

Versions of Flatpak before 1.0.8, 1.1.x, 1.2.x before 1.2.4, and 1.3.x before 1.3.1

Exploitation Mechanism

The vulnerability enables the injection of commands into the controlling terminal, executing them outside the sandbox after the sandboxed application ends.
Incomplete fix on 64-bit platforms allows bypassing the seccomp filter using specific ioctl request numbers.

Mitigation and Prevention

Steps to mitigate and prevent the CVE-2019-10063 vulnerability.

Immediate Steps to Take

Update Flatpak to versions 1.0.8, 1.2.4, or 1.3.1 and above to address the sandbox bypass vulnerability.
Monitor for any suspicious activities on the system.

Long-Term Security Practices

Regularly update software and applications to the latest versions to patch known vulnerabilities.
Implement strong access controls and monitoring mechanisms to prevent unauthorized access.

Patching and Updates

Apply patches and updates provided by Flatpak to ensure the security of the system.