SB2021050641 - openEuler 20.03 LTS SP1 update for flatpak

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Privilege escalation (CVE-ID: CVE-2019-8308)

The vulnerability allows an adjacent attacker to escalate privileges on the system.

The vulnerability exists due an error when handling file descriptors related to /proc/self/exe. An adjacent attacker can trick the victim with root privileges into installing a system-wide Flatpak application that has an apply_extra script, and then run the apply_extra script in a sandbox with /proc mounted to escape sandbox protections and maliciously modify executable files as root on the host system.

2) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2021-21381)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper input validation within the "file forwarding" feature. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1149