Sandbox Bypass Vulnerability in Flatpak by Collabora

CVE-2019-10063

What is CVE-2019-10063?

Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux, is susceptible to a sandbox bypass vulnerability due to an incomplete seccomp filter implementation. This flaw allows attackers to exploit the interaction between ioctls by crafting malicious ioctl requests that trigger execution of commands outside the sandbox environment. By leveraging a combination of specific bit manipulations in the ioctl request, unauthorized commands can potentially be injected, compromising the security model intended to isolate applications.

References