PT-2021-14370 · Flatpak+6 · Flatpak+6

Simon Mcvittie · Published 2021-01-14 · Updated 2024-06-15 · CVE-2021-21261

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Flatpak versions 0.11.4 through 1.8.4 Flatpak versions 1.9.0 through 1.9.3

Description: A bug was discovered in the flatpak-portal service that can allow sandboxed applications to execute arbitrary code on the host system. The Flatpak portal D-Bus service (flatpak-portal, also known by its D-Bus service name org.freedesktop.portal.Flatpak) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the flatpak run command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the flatpak run command, and use them to execute arbitrary code that is not in a sandbox.

Recommendations: For versions 0.11.4 through 1.8.4, update to version 1.8.5 or later. For versions 1.9.0 through 1.9.3, update to version 1.9.4 or later. As a temporary workaround, consider preventing the flatpak-portal service from starting, but this mitigation will prevent many Flatpak apps from working correctly.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

ALT-PU-2021-1042

CESA-2021_0304

CESA-2021_0411

CVE-2021-21261

DSA-4830-1

DSA-4830-2

GHSA-4PPF-FXF6-VXG2

MGASA-2021-0143

OESA-2021-1043

OPENSUSE-SU-2021:0520-1

OPENSUSE-SU-2021_0520-1

OPENSUSE-SU-2024:10762-1

RHSA-2021:0304

RHSA-2021:0306

RHSA-2021:0307

RHSA-2021:0411

RHSA-2021_0304

RHSA-2021_0411

SUSE-SU-2021:1094-1

SUSE-SU-2021_1094-1

SUSE-SU-2022:2990-1

SUSE-SU-2022:3284-1

SUSE-SU-2022_2990-1

SUSE-SU-2022_3284-1

USN-4721-1

Affected Products

Alt Linux

Centos

Flatpak

Linuxmint

Red Hat

Suse

Ubuntu

References · 63

• https://github.com/flatpak/flatpak/commit/aeb6a7ab0abaac4a8f4ad98b3df476d9de6b8bd4 · Patch
• https://github.com/flatpak/flatpak/commit/6d1773d2a54dde9b099043f07a2094a4f1c2f486 · Patch
• https://github.com/flatpak/flatpak/commit/6e5ae7a109cdfa9735ea7ccbd8cb79f9e8d3ae8b · Patch
• https://linux.oracle.com/errata/ELSA-2021-0411.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21261 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21261 · Vendor Advisory
• https://debian.org/security/2021/dsa-4830 · Vendor Advisory
• https://security.gentoo.org/glsa/202101-21 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21261 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21261 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:1094-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4830-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4721-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-0304.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0520-1 · Vendor Advisory