Alibaba Cloud Linux 3 : 0127: flatpak (ALINUX3-SA-2024:0127)

high Nessus Plugin ID 236046

Synopsis

The remote Alibaba Cloud Linux host is missing one or more security updates.

Description

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0127 advisory.

Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

CVE-2024-32462:
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg- desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 236046

File Name: alinux3_sa_2024-0127.nasl

Version: 1.1

Type: local

Family: Alibaba Cloud Linux Local Security Checks

Published: 5/14/2025

Updated: 5/14/2025

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-32462

CVSS v3

Risk Factor: High

Base Score: 8.4

Temporal Score: 7.3

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:alibabacloud:alibaba_cloud_linux_3, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:flatpak-tests, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:flatpak-debugsource, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:flatpak-selinux, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:flatpak-tests-debuginfo, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:flatpak-debuginfo, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:flatpak-libs-debuginfo, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:flatpak-session-helper, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:flatpak, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:flatpak-session-helper-debuginfo, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:flatpak-devel, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:flatpak-libs

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Alibaba/release, Host/Alibaba/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 6/20/2024

Vulnerability Publication Date: 4/18/2024

Reference Information

CVE: CVE-2024-32462

Detections

Analytics