CVE-2019-10063 Security feature bypass in n/a

Critical 9.0 Published 26 Mar 2019 Updated 4 Aug 2024

Attackers can bypass Flatpak sandbox restrictions on 64-bit systems to execute arbitrary commands outside the sandbox via a flawed seccomp filter.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-10063?

CVE-2019-10063 is a critical vulnerability in n/a, published on 26 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.

Weakness: CWE-20

Which versions are affected by CVE-2019-10063?

It affects 1 product.

Linux distribution packages (25)

`flatpak` Red Hat:enterprise_linux:7::client	All versions	`0:1.0.2-5.el7_6`
`flatpak-builder` Red Hat:enterprise_linux:7::client	All versions	`0:1.0.0-5.el7_6`
`flatpak-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:1.0.2-5.el7_6`
`flatpak-devel` Red Hat:enterprise_linux:7::client	All versions	`0:1.0.2-5.el7_6`
`flatpak-libs` Red Hat:enterprise_linux:7::client	All versions	`0:1.0.2-5.el7_6`
`flatpak` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.0.2-5.el7_6`
`flatpak-builder` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.0.0-5.el7_6`
`flatpak-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.0.2-5.el7_6`
`flatpak-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.0.2-5.el7_6`
`flatpak-libs` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.0.2-5.el7_6`
`flatpak` Red Hat:enterprise_linux:7::server	All versions	`0:1.0.2-5.el7_6`
`flatpak-builder` Red Hat:enterprise_linux:7::server	All versions	`0:1.0.0-5.el7_6`
`flatpak-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:1.0.2-5.el7_6`
`flatpak-devel` Red Hat:enterprise_linux:7::server	All versions	`0:1.0.2-5.el7_6`
`flatpak-libs` Red Hat:enterprise_linux:7::server	All versions	`0:1.0.2-5.el7_6`
`flatpak` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.0.2-5.el7_6`
`flatpak-builder` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.0.0-5.el7_6`
`flatpak-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.0.2-5.el7_6`
`flatpak-devel` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.0.2-5.el7_6`
`flatpak-libs` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.0.2-5.el7_6`
`flatpak` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.0.6-3.el8_0`
`flatpak-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.0.6-3.el8_0`
`flatpak-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.0.6-3.el8_0`
`flatpak-libs` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.0.6-3.el8_0`
`flatpak-libs-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.0.6-3.el8_0`

Products include Flatpak Flatpak.

How do I fix CVE-2019-10063?

Upgrade to a fixed version.

Is CVE-2019-10063 being exploited?

There is no known exploitation of CVE-2019-10063 in the wild and no public exploit code.

Sources

Also known as CLEANSTART-2024-SG68553, DEBIAN-CVE-2019-10063, GHSA-mc9j-733x-89cx, OESA-2021-1380, RHSA-2019:1024, RHSA-2019:1143 and 1 more.