high
8.8
CWE
20
Advisory Published
Updated

CVE-2021-41133: Sandbox bypass via recent VFS-manipulating syscalls

First published: Fri Oct 08 2021(Updated: )

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.

Credit: security-advisories@github.com security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
debian/flatpak<=1.10.3-0+deb11u1<=1.11.3-2<=1.2.5-0+deb10u4
1.12.0-1
1.10.5-0+deb11u1
debian/0.5.0-1
<1.8.2
>=1.10.0<1.10.4
>=1.11.1<1.12.1
=11.0
=33
=34
Flatpak Flatpak<1.8.2
Flatpak Flatpak>=1.10.0<1.10.4
Flatpak Flatpak>=1.11.1<1.12.1
Debian Debian Linux=11.0
Fedoraproject Fedora=33
Fedoraproject Fedora=34
debian/flatpak<=1.2.5-0+deb10u4
1.10.8-0+deb11u1
1.10.7-0+deb11u1
1.14.4-1
1.14.5-1

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the vulnerability ID for this Flatpak vulnerability?

    The vulnerability ID for this Flatpak vulnerability is CVE-2021-41133.

  • What is Flatpak?

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

  • What is the severity of CVE-2021-41133?

    The severity of CVE-2021-41133 is high with a CVSS score of 7.8.

  • What is the affected software for CVE-2021-41133?

    The affected software for CVE-2021-41133 includes Flatpak versions prior to 1.10.4 and 1.12.0, as well as Debian Debian Linux 11.0 and Fedoraproject Fedora 33 and 34.

  • How can CVE-2021-41133 be exploited?

    CVE-2021-41133 can be exploited by Flatpak apps with direct access to AF_UNIX sockets tricking portals and other host-OS services.

  • How do I fix CVE-2021-41133?

    To fix CVE-2021-41133, it is recommended to update Flatpak to version 1.10.4 or 1.12.0, or apply the appropriate updates provided by Debian or Fedoraproject.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203