Описание
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox.
Отчет
Red Hat's CVSSv3.1 score has been calculated from the upstream-provided CVSSv4 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). The resulting CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector reflects a network-exploitable flaw with low attack complexity and no privileges required, but requiring a user (via a malicious/compromised Flatpak app) to interact with the D-Bus session bus. The proxy's failure to validate reply-serial numbers on non-reply messages allows a sandboxed app to bypass its message filter and reach otherwise-blocked D-Bus interfaces, resulting in a full loss of confidentiality, integrity, and availability of the host system outside the sandbox.
Меры по смягчению последствий
Avoid running untrusted Flatpak apps and avoid running untrusted apps via other frameworks that use xdg-dbus-proxy.
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.
An incorrect implementation of message filtering in xdg-dbus-proxy ver ...
EPSS
8.8 High
CVSS3