Log in Start free

Vulnerability · Published Mar 16, 2023 · Assigned by GitHub_M

CVE-2023-28100TIOCLINUX can send commands outside sandbox if running on a virtual console

Critical 10.0

In plain English

A critical-severity improper input validation in flatpak from flatpak. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.9%top 41.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be used in a Wayland or X11 graphical environment.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8flatpak1.10.8-1.el8ALSA-2023:7038
AlmaLinux:9flatpak1.12.8-1.el9ALSA-2023:6518
AlmaLinux:8flatpak-devel1.10.8-1.el8ALSA-2023:7038
AlmaLinux:9flatpak-devel1.12.8-1.el9ALSA-2023:6518
AlmaLinux:8flatpak-libs1.10.8-1.el8ALSA-2023:7038
AlmaLinux:9flatpak-libs1.12.8-1.el9ALSA-2023:6518
AlmaLinux:8flatpak-selinux1.10.8-1.el8ALSA-2023:7038
AlmaLinux:9flatpak-selinux1.12.8-1.el9ALSA-2023:6518
AlmaLinux:8flatpak-session-helper1.10.8-1.el8ALSA-2023:7038
AlmaLinux:9flatpak-session-helper1.12.8-1.el9ALSA-2023:6518
Debian:12flatpak1.14.4-1DEBIAN-CVE-2023-28100
Debian:13flatpak1.14.4-1DEBIAN-CVE-2023-28100
Debian:14flatpak1.14.4-1DEBIAN-CVE-2023-28100
Rocky Linux:9flatpak0:1.12.8-1.el9RLSA-2023:6518
Ubuntu:25.10flatpakno fix listedUBUNTU-CVE-2023-28100
Ubuntu:26.10flatpakno fix listedUBUNTU-CVE-2023-28100

Affected products (as reported)

VendorProductVersions
flatpak flatpak < 1.10.8>= 1.12.0, < 1.12.8>= 1.14.0, < 1.14.4>= 1.15.0, < 1.15.4

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References