CVE-2021-41133

Publication date 8 October 2021

Last updated 24 July 2024


Ubuntu priority

Cvss 3 Severity Score

7.8 · High

Score breakdown

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.

Read the notes from the security team

Status

Package Ubuntu Release Status
flatpak 22.04 LTS jammy
Not affected
21.10 impish
Fixed 1.10.2-3ubuntu0.1
21.04 hirsute
Fixed 1.10.2-1ubuntu1.1
20.04 LTS focal
Fixed 1.6.5-0ubuntu0.4
18.04 LTS bionic
Fixed 1.0.9-0ubuntu0.4
16.04 LTS xenial Ignored end of standard support
14.04 LTS trusty Not in release

Notes


alexmurray

Requires libseccomp>=2.5.0 - this is only in the updates pocket in focal and bionic so libseccomp needs to be published to the security pocket in those releases as well to ensure this vulnerability is properly mitigated.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
flatpak

Severity score breakdown

Parameter Value
Base score 7.8 · High
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-5191-1
    • Flatpak vulnerability
    • 14 December 2021

Other references