New Update Flatpak 1.18.1 Fixes Sandbox Escape and Root Privilege Escalation Flaws

[lokamoka820]

Flatpak 1.18.1 has been released as a security-focused update to the popular Linux application sandboxing and distribution framework, addressing a substantial collection of vulnerabilities affecting sandbox isolation, filesystem access, privilege boundaries, and OCI handling.

The most critical fix in this release stops a sandbox escape that could let an app read and write anywhere on the host filesystem. Another key fix stops a local root privilege escalation caused by symlink path traversal in revokefs and commit tampering.

Moreover, the release fixes two other issues that could let files be written with root privileges: one in extra-data extraction using symlinks and path traversal, and another in flatpak build-init.

The update also brings several security fixes for OCI features. Developers fixed a hardlink path traversal bug during OCI archive extraction that could let attackers read any host file. They also fixed a buffer overflow in OCI delta stream path names on 32-bit systems.

Another fixed vulnerability was a symlink attack on .ld.so, which could let files with set names be written anywhere on the filesystem. Flatpak 1.18.1 also improves downgrade protection by closing a loophole that let unprivileged users bypass safeguards and downgrade installed apps.

Besides security fixes, this release includes regular bug fixes. It corrects a regression in environment handling for the portal’s flatpak-spawn feature and fixes problems with negated permission strings used in the allow and share run options.

The update also fixes a build failure when exporting metainfo releases.xml files, as well as crashes in the portal update monitor and OCI JSON processing. Now, Flatpak returns an error if file forwarding is tried with an empty path.

There are more improvements to OCI infrastructure. Now, the system helper verifies signatures using the mirrored repository instead of the lookaside server, TLS certificates are correctly used for OCI registry requests, and stream write failures are now passed on to curl.

For additional details, see the changelog. Most users will receive the update through their Linux distribution’s package repositories once maintainers package it.

Flatpak 1.18.1 Fixes Sandbox Escape and Root Privilege Escalation Flaws

Flatpak 1.18.1 is out with security fixes addressing a sandbox escape, local root privilege escalation, path traversal issues, and arbitrary file writes.

linuxiac.com

 

[lokamoka820]

Flatpak 1.18.2 Released as a Bug-Fix Update

Flatpak 1.18.2 has been released as the second maintenance update in the 1.18 series, bringing bug fixes for sandbox handling, the system helper, portals, repository metadata validation, and build compatibility.

The most visible fix addresses a crash in the system helper that could occur when iterating through cache directories. The update also fixes another system-helper issue where the wrong D-Bus sender was tracked during pull operations.

Several sandbox-related problems have been corrected as well. Flatpak now properly handles an EAGAIN response from openat2, which previously could prevent extensions from populating inside the sandbox.

Another fix addresses a portal issue where sandbox-expose-fd-ro could pass the wrong file descriptor during a descriptor-remapping collision.

On the repository handling side, Flatpak now validates the GVariant structure of repository summaries before using generated variant readers, improving robustness when processing repository metadata.

Finally, the update prevents corrupted output when error messages contain non-UTF-8 characters, and restores build compatibility for systems using GLib versions older than 2.72.

For more details on all changes in Flatpak 1.18.2, see the changelog.

Flatpak 1.18.2 Released as a Bug-Fix Update

Flatpak 1.18.2 is out with fixes for a system helper crash, sandbox extensions, portal file descriptors, and older GLib builds.

linuxiac.com