Flatpak Vulnerability Allows Sandbox Escape
CVE-2024-32462

8.4HIGH

Key Information:

Vendor: Flatpak
Status: Flatpak
Vendor: CVE Published:; 18 April 2024

Badges

👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2024-32462?

The vulnerability CVE-2024-32462 in the Flatpak software system for Linux allows a malicious or compromised Flatpak app to execute arbitrary code outside its sandbox in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8. The vulnerability can be exploited by passing bwrap arguments to the --command= argument of flatpak run and has been mitigated in xdg-desktop-portal version 1.18.4. This could have a significant impact on the security of Linux systems, particularly regarding sandboxed applications. At this time, there are no known exploits of this vulnerability by ransomware groups.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

flatpak < 1.10.9 < 1.10.9

flatpak >= 1.12.0, < 1.12.9 < 1.12.0, 1.12.9

flatpak >= 1.14.0, < 1.14.6 < 1.14.0, 1.14.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-32462
Created by SpiralBL0CK