CVE-2019-10063 - CVE House
Back to Database
Status published Critical CVE-2019-10063

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x...

Vulnerability Description

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-10063

Credits & Attribution

No credits recorded in the NVD database.

References

More from flatpak

View All →
CVE-2024-42472
Flatpak may allow access to files outside sandbox for certain apps
Critical 10
CVE-2024-32462
Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing
High 8.4
CVE-2023-28101
Flatpak metadata with ANSI control codes can cause misleading terminal output
Medium 5
CVE-2023-28100
TIOCLINUX can send commands outside sandbox if running on a virtual console
Critical 10
CVE-2022-21682
flatpak-builder can access files outside the build directory.
High 7.7

Affected Vendor

Affected Software

flatpak
Vulnerable Versions:
0, 1.1.0, 1.2.0, 1.3.0

Timeline

Official Publish: March 26th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.