CyberRota Analysis
AI-GeneratedFlatpak versions prior to 1.18.1 are vulnerable due to a flaw in the revokefs writer that allows local users to exploit symlink traversal, enabling them to manipulate files across different revokefs sessions. This vulnerability can lead to unauthorized modifications of ostree commit objects, potentially allowing attackers to escalate privileges to root. Organizations using Flatpak should prioritize patching this vulnerability to mitigate the risk of local privilege escalation and unauthorized file access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.