CVE-2023-28100: fallo crítico en flatpak
TIOCLINUX can send commands outside sandbox if running on a virtual console
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 10epss 0.9%
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be used in a Wayland or X11 graphical environment.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Productos afectados
flatpak · flatpakCVEs relacionadas — flatpak
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-21682HIGHflatpak-builder can access files outside the build directory.EPSS 1.8%CVE-2026-34078CRITICALFlatpak has a complete sandbox escape leading to host file access and code execution in the host contextEPSS 1.7%CVE-2021-21381HIGHSandbox escape via special tokens in .desktop fileEPSS 1.5%CVE-2021-43860HIGHPermissions granted to applications can be hidden from the user at install timeEPSS 1.4%CVE-2024-42472CRITICALFlatpak may allow access to files outside sandbox for certain appsEPSS 1.3%CVE-2023-28101MEDIUMFlatpak metadata with ANSI control codes can cause misleading terminal outputEPSS 0.9%