Debian LinuxOperating system · Debian
CVE-2024-42472
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedFlatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality. When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access. However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code. For the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson "wrap" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceFlatpak versions prior to 1.14.10 and 1.15.10 have a symlink attack vulnerability in the persistent directory feature. Applications with --persist permissions get a bind mount to ~/.var/app/$APPID/subdir, but since they can write to the parent directory, they can replace the source with a symlink to escape the sandbox and access files outside the intended scope. Partial patches exist but leave a race condition exploitable by parallel app instances.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
Debian LinuxOperating system
= 11.0>= 1.14.0, < 1.14.10>= 1.15.0, < 1.15.10CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check installed Flatpak versionRun `flatpak --version` to determine the installed Flatpak versionAffected if Version is less than 1.14.10 or is between 1.14.x (inclusive) and 1.14.10, or between 1.15.0 (inclusive) and 1.15.10
-
Identify Flatpak applications with persist permissionsSearch Flatpak manifest files or installed app configurations for the --persist flag or persist directory definitionsAffected if Any installed Flatpak application is configured with persist permissions pointing to user-accessible directories
-
Check for ~/.var/app directory contentsInspect the directory ~/.var/app for subdirectories corresponding to installed Flatpak apps - these are the persistent storage locations that could be exploitedAffected if Multiple Flatpak apps are installed and have created persistent directories in ~/.var/app, especially if those apps have write access to parent directories
-
Verify bubblewrap is in useCheck that Flatpak is using bubblewrap for sandboxing by examining the Flatpak runtime configuration or running `flatpak info --show-details` on suspect appsAffected if Flatpak uses bubblewrap for bind mounts and the version is in the affected range, making the symlink attack possible
A user is affected if they are running any Flatpak version prior to 1.14.10 or 1.15.10 AND have applications installed that utilize the --persist feature for directory access.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped1.14.101.15.10
Update to Flatpak 1.14.10 or 1.15.10 (or backport the bubblewrap --bind-fd patch and Flatpak changes), or avoid using applications with persistent/--persist permissions as a workaround.
Flatpak 1.14.10 (stable branch) or Flatpak 1.15.10 (development branch)
- Upgrade Flatpak to version 1.14.10 or later for the 1.14.x stable branch
- Upgrade Flatpak to version 1.15.10 or later for the 1.15.x development branch
- If using system_bubblewrap (typically /usr/bin/bwrap), ensure bubblewrap is also updated to version 0.6.3 (for 1.14.x) or 0.10.0 (for 1.15.x) with the --bind-fd patch applied
- If using bundled bubblewrap (typically /usr/libexec/flatpak-bwrap), the bundled version in Flatpak 1.14.10 and 1.15.10 already includes the necessary updates
- For Debian 11.0, apply vendor patches/backports or consider upgrading to a newer Debian release that includes the fixed Flatpak version
- As a temporary workaround if upgrading is not immediately possible, avoid using applications that employ the persistent (--persist) permission
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Debian Linux
Scoped from the published advisory
- Consultation4.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,888.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2024-42472 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2024-42472 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data