Skip to content
Fencer Vulns
high 8.4

CVE-2024-32462 json

Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing

published 2024-04-18 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-30279

cvss
8.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.

Patch / fix

  • flatpak flatpak 1.15.8
  • flatpak Debian 12 1.14.4-1+deb12u1
  • flatpak Debian 14, Debian 13 1.14.6-1

debian advisories DEBIAN-CVE-2024-32462

  • flatpak Ubuntu 24.04 LTS 1.14.6-1

ubuntu advisories UBUNTU-CVE-2024-32462

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • flatpak RHEL 7 1.0.9-13.el7_9
  • flatpak-libs RHEL 7 1.0.9-13.el7_9
  • flatpak-builder RHEL 7 1.0.0-13.el7_9
  • flatpak RHEL 8 1.12.9-1.el8_10
  • flatpak-libs RHEL 8 1.12.9-1.el8_10
  • flatpak-selinux RHEL 8 1.12.9-1.el8_10
  • flatpak-session-helper RHEL 8 1.12.9-1.el8_10
  • flatpak RHEL 9 1.12.9-1.el9_4

red hat advisories RHSA-2024:3980RHSA-2024:3979RHSA-2024:3969RHSA-2024:3970RHSA-2024:3963RHSA-2024:3962

  • wayland-protocols SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 1.36-150500.3.3.1
  • flatpak SLE Module for Desktop Applications 15 SP6, openSUSE Leap 15.6 1.16.0-150600.3.6.1
  • flatpak SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 1.16.0-150500.3.15.1
  • bubblewrap SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Module for Basesystem 15 SP6 +3 more 0.11.0-150500.3.9.1
  • xdg-desktop-portal SLE Module for Desktop Applications 15 SP6, openSUSE Leap 15.6 1.18.2-150600.4.3.1
  • xdg-desktop-portal SLES for SAP 12 SP5, SLES 12 SP5 1.4.2-3.3.1
  • xdg-desktop-portal SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +4 more 1.8.0-150200.5.6.1
  • xdg-desktop-portal SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 1.10.1-150400.3.6.1

suse advisories SUSE-RU-2025:0145-1SUSE-SU-2024:2067-1SUSE-SU-2024:1832-1SUSE-SU-2024:1831-1SUSE-SU-2024:1806-1SUSE-SU-2024:1803-1

  • flatpak openSUSE Tumbleweed 1.15.8-1.1

opensuse advisories openSUSE-SU-2024:13899-1

  • flatpak AlmaLinux 9 1.12.9-1.el9_4
  • flatpak-libs AlmaLinux 9 1.12.9-1.el9_4
  • flatpak-selinux AlmaLinux 9 1.12.9-1.el9_4
  • flatpak-session-helper AlmaLinux 9 1.12.9-1.el9_4
  • flatpak AlmaLinux 8 1.12.9-1.el8_10
  • flatpak-libs AlmaLinux 8 1.12.9-1.el8_10
  • flatpak-selinux AlmaLinux 8 1.12.9-1.el8_10
  • flatpak-session-helper AlmaLinux 8 1.12.9-1.el8_10

almalinux advisories ALSA-2024:3959ALSA-2024:3961

  • flatpak Rocky Linux 9 1.12.9-1.el9_4
  • flatpak Rocky Linux 8 1.12.9-1.el8_10

rocky linux advisories RLSA-2024:3959RLSA-2024:3961

  • flatpak Alpine 3.19, Alpine 3.18, Alpine 3.17 1.14.6-r0
  • flatpak Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 1.14.6-r1

alpine advisories ALPINE-CVE-2024-32462

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-32462 updated cvss 8.4

flatpak: sandbox escape via RequestBackground portal

  • Red Hat Enterprise Linux 10 flatpak
    affected: workaround, no fix available
  • Red Hat CodeReady Linux Builder EUS (v.8.8) flatpak 1.10.7-2.el8_8, flatpak-session-helper 1.10.7-2.el8_8
    fixed: vendor fix RHSA-2024:3962
  • Red Hat CodeReady Linux Builder EUS (v.9.2) flatpak 1.12.7-3.el9_2, flatpak-session-helper 1.12.7-3.el9_2
    fixed: vendor fix RHSA-2024:3960
  • Red Hat Enterprise Linux AppStream (v. 8) flatpak 1.12.9-1.el8_10, flatpak-libs 1.12.9-1.el8_10, flatpak-selinux 1.12.9-1.el8_10, flatpak-session-helper 1.12.9-1.el8_10
    fixed: vendor fix RHSA-2024:3961
  • Red Hat Enterprise Linux AppStream (v. 9) flatpak 1.12.9-1.el9_4, flatpak-libs 1.12.9-1.el9_4, flatpak-selinux 1.12.9-1.el9_4, flatpak-session-helper 1.12.9-1.el9_4
    fixed: vendor fix RHSA-2024:3959
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) flatpak 1.6.2-7.el8_2, flatpak-libs 1.6.2-7.el8_2, flatpak-selinux 1.6.2-7.el8_2, flatpak-session-helper 1.6.2-7.el8_2
    fixed: vendor fix RHSA-2024:3979
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) flatpak 1.8.5-5.el8_4, flatpak-libs 1.8.5-5.el8_4, flatpak-selinux 1.8.5-5.el8_4, flatpak-session-helper 1.8.5-5.el8_4
    fixed: vendor fix RHSA-2024:3963
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) flatpak 1.8.7-2.el8_6, flatpak-libs 1.8.7-2.el8_6, flatpak-selinux 1.8.7-2.el8_6, flatpak-session-helper 1.8.7-2.el8_6
    fixed: vendor fix RHSA-2024:3969
show 11 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) flatpak 1.8.5-5.el8_4, flatpak-libs 1.8.5-5.el8_4, flatpak-selinux 1.8.5-5.el8_4, flatpak-session-helper 1.8.5-5.el8_4
    fixed: vendor fix RHSA-2024:3963
  • Red Hat Enterprise Linux AppStream E4S (v.8.6) flatpak 1.8.7-2.el8_6, flatpak-libs 1.8.7-2.el8_6, flatpak-selinux 1.8.7-2.el8_6, flatpak-session-helper 1.8.7-2.el8_6
    fixed: vendor fix RHSA-2024:3969
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) flatpak 1.12.5-3.el9_0, flatpak-libs 1.12.5-3.el9_0, flatpak-selinux 1.12.5-3.el9_0, flatpak-session-helper 1.12.5-3.el9_0
    fixed: vendor fix RHSA-2024:3970
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) flatpak 1.10.7-2.el8_8, flatpak-libs 1.10.7-2.el8_8, flatpak-selinux 1.10.7-2.el8_8, flatpak-session-helper 1.10.7-2.el8_8
    fixed: vendor fix RHSA-2024:3962
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) flatpak 1.12.7-3.el9_2, flatpak-libs 1.12.7-3.el9_2, flatpak-selinux 1.12.7-3.el9_2, flatpak-session-helper 1.12.7-3.el9_2
    fixed: vendor fix RHSA-2024:3960
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) flatpak 1.8.5-5.el8_4, flatpak-libs 1.8.5-5.el8_4, flatpak-selinux 1.8.5-5.el8_4, flatpak-session-helper 1.8.5-5.el8_4
    fixed: vendor fix RHSA-2024:3963
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) flatpak 1.8.7-2.el8_6, flatpak-libs 1.8.7-2.el8_6, flatpak-selinux 1.8.7-2.el8_6, flatpak-session-helper 1.8.7-2.el8_6
    fixed: vendor fix RHSA-2024:3969
  • Red Hat Enterprise Linux Client (v. 7) flatpak 1.0.9-13.el7_9, flatpak-libs 1.0.9-13.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) flatpak-builder 1.0.0-13.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) flatpak 1.0.9-13.el7_9, flatpak-libs 1.0.9-13.el7_9, flatpak-builder 1.0.0-13.el7_9
    fixed: vendor fix RHSA-2024:3980
  • Red Hat Enterprise Linux CRB (v. 8) flatpak 1.12.9-1.el8_10, flatpak-session-helper 1.12.9-1.el8_10
    fixed: vendor fix RHSA-2024:3961
  • Red Hat Enterprise Linux CRB (v. 9) flatpak 1.12.9-1.el9_4, flatpak-session-helper 1.12.9-1.el9_4
    fixed: vendor fix RHSA-2024:3959
  • Red Hat Enterprise Linux Server (v. 7) flatpak 1.0.9-13.el7_9, flatpak-libs 1.0.9-13.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) flatpak-builder 1.0.0-13.el7_9 Red Hat Enterprise Linux Workstation (v. 7) flatpak 1.0.9-13.el7_9, flatpak-libs 1.0.9-13.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) flatpak-builder 1.0.0-13.el7_9
    fixed: vendor fix RHSA-2024:3980

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected products

  • flatpak flatpak

Classification

Weakness
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.