Permissions, Privileges, and Access Controls in Flatpak - CVE-2021-43860

Vulnerability identifier: #VU59654

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-43860

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, which leads to security restrictions bypass and privilege escalation.

Flatpak
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Desktop
openEuler
Fedora
flatpak (Debian package)
flatpak
flatpak-debugsource
flatpak-devel
flatpak-debuginfo
flatpak-help
flatpak-builder
typelib-1_0-Flatpak-1_0
libflatpak0-debuginfo
libflatpak0
flatpak-zsh-completion
flatpak-session-helper
flatpak-libs
flatpak-selinux
flatpak (Red Hat package)
system-user-flatpak
sys-apps/flatpak

Install updates from vendor's website.

Flatpak - addressed in versions 1.8.7, 1.10.6, 1.12.3
flatpak (Debian package) - update to 1.10.7-0+deb11u1
flatpak - update to 1.0.3-10
flatpak-debugsource - update to 1.0.3-10
flatpak-devel - update to 1.0.3-10
flatpak-debuginfo - update to 1.0.3-10
flatpak-help - update to 1.0.3-10
flatpak-builder - update to 1.2.2-1.fc34
typelib-1_0-Flatpak-1_0 - addressed in versions 1.2.3-150100.4.8.1, 1.10.7-4.12.1
libflatpak0-debuginfo - addressed in versions 1.2.3-150100.4.8.1, 1.10.7-4.12.1
libflatpak0 - addressed in versions 1.2.3-150100.4.8.1, 1.10.7-4.12.1
flatpak-zsh-completion - addressed in versions 1.2.3-150100.4.8.1, 1.10.7-4.12.1
flatpak-devel - addressed in versions 1.2.3-150100.4.8.1, 1.10.7-4.12.1
flatpak-debugsource - addressed in versions 1.2.3-150100.4.8.1, 1.10.7-4.12.1
flatpak-debuginfo - addressed in versions 1.2.3-150100.4.8.1, 1.10.7-4.12.1
flatpak - addressed in versions 1.2.3-150100.4.8.1, 1.10.7-4.12.1
flatpak-session-helper - update to 1.8.7-1
flatpak-libs - update to 1.8.7-1
flatpak - update to 1.8.7-1
flatpak-selinux - update to 1.8.7-1
flatpak (Red Hat package) - update to 1.8.7-1.el8
flatpak - addressed in versions 1.10.6-1.fc34, 1.10.7-1.fc34, 1.12.3-1.fc35
system-user-flatpak - update to 1.10.7-4.12.1
sys-apps/flatpak - update to 1.14.4

• https://github.com/flatpak/flatpak/commit/d9a8f9d8ccc0b7c1135d0ecde006a75d25f66aee
• https://github.com/flatpak/flatpak/commit/65cbfac982cb1c83993a9e19aa424daee8e9f042
• https://github.com/flatpak/flatpak/commit/93357d357119093804df05acc32ff335839c6451
• https://github.com/flatpak/flatpak/commit/ba818f504c926baaf6e362be8159cfacf994310e
• https://github.com/flatpak/flatpak/security/advisories/GHSA-qpjc-vq3c-572j
• https://github.com/flatpak/flatpak/commit/54ec1a482dfc668127eaae57f135e6a8e0bc52da
• https://github.com/flatpak/flatpak/releases/tag/1.12.3
• https://github.com/flatpak/flatpak/releases/tag/1.10.6
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APFTBYGJJVJPFVHRXUW5PII5XOAFI4KH/
• https://github.com/flatpak/flatpak/releases/tag/1.8.7

• Privilege escalation in Flatpak
• Debian update for flatpak
• Red Hat Enterprise Linux 8 update for flatpak
• SUSE update for flatpak
• SUSE update for flatpak
• Gentoo update for Flatpak
• openEuler update for flatpak
• Fedora 35 update for flatpak
• Fedora 34 update for flatpak
• Fedora 34 update for flatpak, flatpak-builder
• Anolis OS update for flatpak