mirror of
https://github.com/flatpak/flatpak.git
synced 2026-09-12 22:22:09 -04:00
Sebastian Wick
70fdf20886
extract_extra_data() had two vulnerabilities: 1. It resolved "files/extra" using g_file_resolve_relative_path() which follows symlinks. A crafted OSTree commit with "files" as a symlink causes extra-data blobs to be written at the symlink target. On system installs this runs as root via the system helper, which validates signatures and checksums but not tree structure. 2. It used g_file_get_child(extradir, name) where name comes from xa.extra-data-sources in the commit metadata. Names containing ".." escape the extra/ directory. This is exploitable through the normal build flow: flatpak build-export rejects "/" but not "..". Replace GFile path operations with fd-relative operations: open "files" with glnx_chaseat using GLNX_CHASE_RESOLVE_NO_SYMLINKS, create "extra" with glnx_chase_and_mkdirat using GLNX_CHASE_RESOLVE_BENEATH, validate extra-data names against ".", "..", and "/", and write with glnx_file_replace_contents_at anchored to the extra directory fd. [smcv: Open checkoutdir_dfd before trying to open its files subdir] Co-authored-by: Simon McVittie <smcv@collabora.com> Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
See https://flatpak.org/ for more information.
Flatpak is available in the package repositories of most Linux distributions and can be installed from there. See https://flatpak.org/setup/ for quick setup instructions for many distributions.
Community discussion happens in #flatpak:matrix.org, on the mailing list, and on the Flathub Discourse.
Read documentation for Flatpak here.
Contributing
Flatpak welcomes contributions from anyone! Here are some ways you can help:
- Fix one of the issues and submit a PR
- Update flatpak's translations and submit a PR
- Improve flatpak's documentation, hosted at http://docs.flatpak.org and developed over in flatpak-docs
- Find a bug and submit a detailed report including your OS, flatpak version, and the steps to reproduce
- Add your favorite application to Flathub by writing a flatpak-builder manifest and submitting it
- Improve the Flatpak support in your favorite Linux distribution
Hacking
See CONTRIBUTING.md
Related Projects
Here are some notable projects in the Flatpak ecosystem:
- Flatseal: An app for managing permissions of Flatpak apps without using the CLI
- Flat-manager: A tool for managing Flatpak repositories