Flatpak 1.18.1 plugs sandbox escapes and local root escalations

Flatpak 1.18.1 fixes multiple vulnerabilities that could let a local attacker escape the application sandbox with full host filesystem access or escalate to root. Simon McVittie announced the release on the oss-security list, saying CVE identifiers have been requested from GitHub but are not assigned yet, so the issues should be tracked by their GHSA IDs for now.

The most severe problems are a sandbox escape that grants full host filesystem read and write access through a symlink attack on application data directories (GHSA-8688-9x26-hhxj), and a local root privilege escalation via revokefs symlink path traversal combined with commit tampering (GHSA-qrwq-7qwx-q9rp). Both were reported by Ee Yang.

Further fixes close arbitrary root writes during extra-data extraction and package build initialization, an arbitrary host file read through hardlink path traversal when unpacking OCI archives, path traversal in appstream deployment and extension metadata that could probe the host or force unintended mounts, fixed-filename writes to chosen locations via a symlink attack involving the dynamic linker, and a buffer overflow in OCI delta stream path names on 32-bit systems. Those reports came from Sebastian Wick, AISLE working with Red Hat, and Yehia Ali Mohamed Ezzat.

Flatpak is widely used to ship sandboxed desktop applications on Linux. Flaws that defeat the sandbox or elevate privileges undermine the isolation users depend on when installing third-party software, so systems that run Flatpak apps should treat the update as urgent.