Code Injection in Flatpak - CVE-2021-21261

Vulnerability identifier: #VU49587

CSH Severity: Low

CVSS v4: 9.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2021-21261

CWE-ID: CWE-94

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to elevate privileges on the system.

The vulnerability exists due to improper input validation when processing environment variables, passed from a sandboxed process to a non-sandboxed process on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app can set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox.

Flatpak
Arch Linux
Gentoo Linux
SUSE CaaS Platform
SUSE Enterprise Storage
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
CentOS
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Module for Basesystem
Ubuntu
openEuler
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
flatpak (Alpine package)
flatpak (Debian package)
flatpak-help
flatpak-devel
flatpak-debuginfo
flatpak-debugsource
flatpak
flatpak (Red Hat package)
flatpak-zsh-completion
libflatpak0
libflatpak0-debuginfo
typelib-1_0-Flatpak-1_0
xdg-desktop-portal-gtk-lang
xdg-desktop-portal-gtk
xdg-desktop-portal-gtk-debuginfo
xdg-desktop-portal-gtk-debugsource
xdg-desktop-portal-lang
xdg-desktop-portal
xdg-desktop-portal-debuginfo
xdg-desktop-portal-debugsource
xdg-desktop-portal-devel
system-user-flatpak
libostree-1-1-debuginfo
libostree-1-1
typelib-1_0-OSTree-1_0
libostree-devel
libostree-debugsource
libostree-debuginfo
libostree
flatpak (Ubuntu package)
libflatpak0 (Ubuntu package)

Install updates from vendor's website.

Flatpak - addressed in versions 1.8.5, 1.10.0
flatpak (Debian package) - update to 1.2.5-0+deb10u2
flatpak-help - update to 1.0.3-3
flatpak-devel - update to 1.0.3-3
flatpak-debuginfo - update to 1.0.3-3
flatpak-debugsource - update to 1.0.3-3
flatpak - update to 1.0.3-3
flatpak (Red Hat package) - addressed in versions 1.0.9-3.el8_1, 1.0.9-10.el7_9, 1.6.2-4.el8_2, 1.6.2-5.el8_3
flatpak - addressed in versions 1.2.3-150100.4.5.2, 1.2.3-150100.4.8.1, 1.10.2-4.6.1
flatpak-debuginfo - addressed in versions 1.2.3-150100.4.5.2, 1.2.3-150100.4.8.1, 1.10.2-4.6.1
flatpak-debugsource - addressed in versions 1.2.3-150100.4.5.2, 1.2.3-150100.4.8.1, 1.10.2-4.6.1
flatpak-devel - addressed in versions 1.2.3-150100.4.5.2, 1.2.3-150100.4.8.1, 1.10.2-4.6.1
flatpak-zsh-completion - addressed in versions 1.2.3-150100.4.5.2, 1.2.3-150100.4.8.1, 1.10.2-4.6.1
libflatpak0 - addressed in versions 1.2.3-150100.4.5.2, 1.2.3-150100.4.8.1, 1.10.2-4.6.1
libflatpak0-debuginfo - addressed in versions 1.2.3-150100.4.5.2, 1.2.3-150100.4.8.1, 1.10.2-4.6.1
typelib-1_0-Flatpak-1_0 - addressed in versions 1.2.3-150100.4.5.2, 1.2.3-150100.4.8.1, 1.10.2-4.6.1
xdg-desktop-portal-gtk-lang - update to 1.8.0-3.3.1
xdg-desktop-portal-gtk - update to 1.8.0-3.3.1
xdg-desktop-portal-gtk-debuginfo - update to 1.8.0-3.3.1
xdg-desktop-portal-gtk-debugsource - update to 1.8.0-3.3.1
xdg-desktop-portal-lang - update to 1.8.0-5.3.2
xdg-desktop-portal - update to 1.8.0-5.3.2
xdg-desktop-portal-debuginfo - update to 1.8.0-5.3.2
xdg-desktop-portal-debugsource - update to 1.8.0-5.3.2
xdg-desktop-portal-devel - update to 1.8.0-5.3.2
system-user-flatpak - update to 1.10.2-4.6.1
libostree-1-1-debuginfo - update to 2020.8-3.3.2
libostree-1-1 - update to 2020.8-3.3.2
typelib-1_0-OSTree-1_0 - update to 2020.8-3.3.2
libostree-devel - update to 2020.8-3.3.2
libostree-debugsource - update to 2020.8-3.3.2
libostree-debuginfo - update to 2020.8-3.3.2
libostree - update to 2020.8-3.3.2
flatpak (Ubuntu package) - addressed in versions 1.0.9-0ubuntu0.2, 1.6.5-0ubuntu0.2, 1.8.2-1ubuntu0.1
libflatpak0 (Ubuntu package) - addressed in versions 1.0.9-0ubuntu0.2, 1.6.5-0ubuntu0.2, 1.8.2-1ubuntu0.1

• https://github.com/flatpak/flatpak/commit/57416f380600d9754df12baf5b227144ff1bb54d
• https://github.com/flatpak/flatpak/commit/6a11007021658518c088ba0cc5e4da27962a940a
• https://github.com/flatpak/flatpak/commit/dcd24941c7087c5f7e8033abe50b178ac02a34af
• https://github.com/flatpak/flatpak/commit/fb1eaefbceeb73f02eb1bc85865d74a414faf8b8
• https://github.com/flatpak/flatpak/releases/tag/1.8.5
• https://github.com/flatpak/flatpak/security/advisories/GHSA-4ppf-fxf6-vxg2
• https://www.debian.org/security/2021/dsa-4830

• Privilege escalation in Flatpak
• Debian update for flatpak
• Arch Linux update for flatpak
• Gentoo update for Flatpak
• Code Injection in flatpak (Alpine package)
• Red Hat Enterprise Linux 8 update for flatpak
• Red Hat Enterprise Linux 8.1 update for flatpak
• Red Hat Enterprise Linux 8.2 update for flatpak
• CentOS 7 update for flatpak
• SUSE update for flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk
• Ubuntu update for flatpak
• SUSE update for flatpak
• SUSE update for flatpak
• Red Hat Enterprise Linux 7 update for flatpak
• openEuler update for flatpak