CVE-2021-41133

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
flatpak	22.04 LTS jammy	Not affected
	21.10 impish	Fixed 1.10.2-3ubuntu0.1
	21.04 hirsute	Fixed 1.10.2-1ubuntu1.1
	20.04 LTS focal	Fixed 1.6.5-0ubuntu0.4
	18.04 LTS bionic	Fixed 1.0.9-0ubuntu0.4
	16.04 LTS xenial	Ignored end of standard support
	14.04 LTS trusty	Not in release

Notes

alexmurray

Requires libseccomp>=2.5.0 - this is only in the updates pocket in focal and bionic so libseccomp needs to be published to the security pocket in those releases as well to ensure this vulnerability is properly mitigated.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
flatpak	Upstream: 1330662 Upstream: a10f52a Upstream: 4c34815 Upstream: 89ae9fe Upstream: 462fca2 Upstream: e26ac75 Upstream: 26b1248 Upstream: 9766ee0 Upstream: d419fa6 Upstream: 3fc8c67

Severity score breakdown

Parameter	Value
Base score	7.8 · High
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

USN-5191-1
Flatpak vulnerability
14 December 2021