CVE-2021-41133
Vulnerability from cvelistv5
Published
2021-10-08 00:00
Modified
2024-08-04 02:59
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS score ?
0.06% (0.19357)
Summary
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.
References
security-advisories@github.comhttp://www.openwall.com/lists/oss-security/2021/10/26/9Mailing List, Third Party Advisory
security-advisories@github.comhttps://github.com/flatpak/flatpak/commit/1330662f33a55e88bfe18e76de28b7922d91a999Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/flatpak/flatpak/commit/26b12484eb8a6219b9e7aa287b298a894b2f34caPatch, Third Party Advisory
security-advisories@github.comhttps://github.com/flatpak/flatpak/commit/462fca2c666e0cd2b60d6d2593a7216a83047aafPatch, Third Party Advisory
security-advisories@github.comhttps://github.com/flatpak/flatpak/commit/4c34815784e9ffda5733225c7d95824f96375e36Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/flatpak/flatpak/commit/89ae9fe74c6d445bb1b3a40e568d77cf5de47e48Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/flatpak/flatpak/commit/9766ee05b1425db397d2cf23afd24c7f6146a69fPatch, Third Party Advisory
security-advisories@github.comhttps://github.com/flatpak/flatpak/commit/a10f52a7565c549612c92b8e736a6698a53db330Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/flatpak/flatpak/commit/e26ac7586c392b5eb35ff4609fe232c52523b2cfPatch, Third Party Advisory
security-advisories@github.comhttps://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4qPatch, Third Party Advisory
security-advisories@github.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5656ONDP2MGKIJMKEC7N2NXCV27WGTC/
security-advisories@github.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5DKCYRC6MFSTFCUP4DELCOUUP3SFEFX/
security-advisories@github.comhttps://security.gentoo.org/glsa/202312-12
security-advisories@github.comhttps://www.debian.org/security/2021/dsa-4984Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2021/10/26/9Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/flatpak/flatpak/commit/1330662f33a55e88bfe18e76de28b7922d91a999Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/flatpak/flatpak/commit/26b12484eb8a6219b9e7aa287b298a894b2f34caPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/flatpak/flatpak/commit/462fca2c666e0cd2b60d6d2593a7216a83047aafPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/flatpak/flatpak/commit/4c34815784e9ffda5733225c7d95824f96375e36Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/flatpak/flatpak/commit/89ae9fe74c6d445bb1b3a40e568d77cf5de47e48Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/flatpak/flatpak/commit/9766ee05b1425db397d2cf23afd24c7f6146a69fPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/flatpak/flatpak/commit/a10f52a7565c549612c92b8e736a6698a53db330Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/flatpak/flatpak/commit/e26ac7586c392b5eb35ff4609fe232c52523b2cfPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4qPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5656ONDP2MGKIJMKEC7N2NXCV27WGTC/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5DKCYRC6MFSTFCUP4DELCOUUP3SFEFX/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202312-12
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-4984Third Party Advisory
Impacted products
Vendor Product Version
flatpak flatpak Version: >= 1.8.0, <= 1.8.2
Version: >= 1.10.0, < 1.10.4
Version: >= 1.11.0, < 1.12.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:flatpak:flatpak:1.10.0:*:*:*:*:*:*:*",
                     "cpe:2.3:a:flatpak:flatpak:1.11.0:*:*:*:*:*:*:*",
                     "cpe:2.3:a:flatpak:flatpak:1.8.0:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "flatpak",
                  vendor: "flatpak",
                  versions: [
                     {
                        lessThanOrEqual: "1.10.4",
                        status: "affected",
                        version: "1.10.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "1.12.0",
                        status: "affected",
                        version: "1.11.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "1.8.2",
                        status: "affected",
                        version: "1.8.0",
                        versionType: "custom",
                     },
                  ],
               },
               {
                  cpes: [
                     "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "fedora",
                  vendor: "fedoraproject",
                  versions: [
                     {
                        status: "affected",
                        version: "34",
                     },
                  ],
               },
               {
                  cpes: [
                     "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "fedora",
                  vendor: "fedoraproject",
                  versions: [
                     {
                        status: "affected",
                        version: "33",
                     },
                  ],
               },
               {
                  cpes: [
                     "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "debian_linux",
                  vendor: "debian",
                  versions: [
                     {
                        status: "affected",
                        version: "11.0",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2021-41133",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-07-30T16:07:06.539565Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-07-30T16:14:27.263Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T02:59:31.388Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/flatpak/flatpak/commit/1330662f33a55e88bfe18e76de28b7922d91a999",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/flatpak/flatpak/commit/26b12484eb8a6219b9e7aa287b298a894b2f34ca",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/flatpak/flatpak/commit/462fca2c666e0cd2b60d6d2593a7216a83047aaf",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/flatpak/flatpak/commit/4c34815784e9ffda5733225c7d95824f96375e36",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/flatpak/flatpak/commit/89ae9fe74c6d445bb1b3a40e568d77cf5de47e48",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/flatpak/flatpak/commit/9766ee05b1425db397d2cf23afd24c7f6146a69f",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/flatpak/flatpak/commit/a10f52a7565c549612c92b8e736a6698a53db330",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/flatpak/flatpak/commit/e26ac7586c392b5eb35ff4609fe232c52523b2cf",
               },
               {
                  name: "FEDORA-2021-4b201d15e6",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5656ONDP2MGKIJMKEC7N2NXCV27WGTC/",
               },
               {
                  name: "DSA-4984",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-4984",
               },
               {
                  name: "[oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/10/26/9",
               },
               {
                  name: "FEDORA-2021-c5a9c85737",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5DKCYRC6MFSTFCUP4DELCOUUP3SFEFX/",
               },
               {
                  name: "GLSA-202312-12",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-12",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "flatpak",
               vendor: "flatpak",
               versions: [
                  {
                     status: "affected",
                     version: ">= 1.8.0, <= 1.8.2",
                  },
                  {
                     status: "affected",
                     version: ">= 1.10.0, < 1.10.4",
                  },
                  {
                     status: "affected",
                     version: ">= 1.11.0, < 1.12.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-20",
                     description: "CWE-20: Improper Input Validation",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-23T10:06:26.199973",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q",
            },
            {
               url: "https://github.com/flatpak/flatpak/commit/1330662f33a55e88bfe18e76de28b7922d91a999",
            },
            {
               url: "https://github.com/flatpak/flatpak/commit/26b12484eb8a6219b9e7aa287b298a894b2f34ca",
            },
            {
               url: "https://github.com/flatpak/flatpak/commit/462fca2c666e0cd2b60d6d2593a7216a83047aaf",
            },
            {
               url: "https://github.com/flatpak/flatpak/commit/4c34815784e9ffda5733225c7d95824f96375e36",
            },
            {
               url: "https://github.com/flatpak/flatpak/commit/89ae9fe74c6d445bb1b3a40e568d77cf5de47e48",
            },
            {
               url: "https://github.com/flatpak/flatpak/commit/9766ee05b1425db397d2cf23afd24c7f6146a69f",
            },
            {
               url: "https://github.com/flatpak/flatpak/commit/a10f52a7565c549612c92b8e736a6698a53db330",
            },
            {
               url: "https://github.com/flatpak/flatpak/commit/e26ac7586c392b5eb35ff4609fe232c52523b2cf",
            },
            {
               name: "FEDORA-2021-4b201d15e6",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5656ONDP2MGKIJMKEC7N2NXCV27WGTC/",
            },
            {
               name: "DSA-4984",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2021/dsa-4984",
            },
            {
               name: "[oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/10/26/9",
            },
            {
               name: "FEDORA-2021-c5a9c85737",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5DKCYRC6MFSTFCUP4DELCOUUP3SFEFX/",
            },
            {
               name: "GLSA-202312-12",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-12",
            },
         ],
         source: {
            advisory: "GHSA-67h7-w3jq-vh4q",
            discovery: "UNKNOWN",
         },
         title: "Sandbox bypass via recent VFS-manipulating syscalls",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-41133",
      datePublished: "2021-10-08T00:00:00",
      dateReserved: "2021-09-15T00:00:00",
      dateUpdated: "2024-08-04T02:59:31.388Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2021-41133\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2021-10-08T14:15:08.723\",\"lastModified\":\"2024-11-21T06:25:33.023\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.\"},{\"lang\":\"es\",\"value\":\"Flatpak es un sistema para construir, distribuir y ejecutar aplicaciones de escritorio en sandbox en Linux. En versiones anteriores a 1.10.4 y 1.12.0, las aplicaciones Flatpak con acceso directo a los sockets AF_UNIX, como los usados por Wayland, Pipewire o pipewire-pulse, pueden engañar a los portales y otros servicios del sistema operativo anfitrión para que traten la aplicación Flatpak como si fuera un proceso ordinario del Sistema Operativo anfitrión sin sandbox. Pueden hacer esto al manipular el VFS usando recientes llamadas al sistema relacionadas con el montaje que no están bloqueadas por el filtro seccomp de Flatpak, para sustituir un \\\"/.flatpak-info\\\" diseñado o hacer que ese archivo desaparezca por completo. Las aplicaciones Flatpak que actúan como clientes de sockets AF_UNIX como los usados por Wayland, Pipewire o pipewire-pulse pueden escalar los privilegios que los servicios correspondientes creerán que presenta la aplicación Flatpak. Ten en cuenta que los protocolos que operan completamente sobre el bus de sesión D-Bus (bus de usuario), el bus de sistema o el bus de accesibilidad no están afectados por esto. Esto es debido al uso de un proceso proxy \\\"xdg-dbus-proxy\\\", cuyo VFS no puede ser manipulado por la app Flatpak, cuando interactúa con estos buses. Se presentan parches para las versiones 1.10.4 y 1.12.0, y en el momento de la publicación, se está planeando un parche para la versión 1.8.2. No se presentan soluciones aparte de la actualización a una versión parcheada\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.8.2\",\"matchCriteriaId\":\"69BAD0B1-DDB3-46FE-8AEB-BF7203829E07\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.10.0\",\"versionEndExcluding\":\"1.10.4\",\"matchCriteriaId\":\"E8521E68-800E-4633-9A6D-2CDDA84B77F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.11.1\",\"versionEndExcluding\":\"1.12.1\",\"matchCriteriaId\":\"00DC4C26-B1FD-4244-85CD-8507B0BFD961\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A930E247-0B43-43CB-98FF-6CE7B8189835\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2021/10/26/9\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/1330662f33a55e88bfe18e76de28b7922d91a999\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/26b12484eb8a6219b9e7aa287b298a894b2f34ca\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/462fca2c666e0cd2b60d6d2593a7216a83047aaf\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/4c34815784e9ffda5733225c7d95824f96375e36\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/89ae9fe74c6d445bb1b3a40e568d77cf5de47e48\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/9766ee05b1425db397d2cf23afd24c7f6146a69f\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/a10f52a7565c549612c92b8e736a6698a53db330\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/e26ac7586c392b5eb35ff4609fe232c52523b2cf\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5656ONDP2MGKIJMKEC7N2NXCV27WGTC/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5DKCYRC6MFSTFCUP4DELCOUUP3SFEFX/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://security.gentoo.org/glsa/202312-12\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://www.debian.org/security/2021/dsa-4984\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/10/26/9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/1330662f33a55e88bfe18e76de28b7922d91a999\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/26b12484eb8a6219b9e7aa287b298a894b2f34ca\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/462fca2c666e0cd2b60d6d2593a7216a83047aaf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/4c34815784e9ffda5733225c7d95824f96375e36\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/89ae9fe74c6d445bb1b3a40e568d77cf5de47e48\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/9766ee05b1425db397d2cf23afd24c7f6146a69f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/a10f52a7565c549612c92b8e736a6698a53db330\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/commit/e26ac7586c392b5eb35ff4609fe232c52523b2cf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5656ONDP2MGKIJMKEC7N2NXCV27WGTC/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5DKCYRC6MFSTFCUP4DELCOUUP3SFEFX/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/202312-12\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.debian.org/security/2021/dsa-4984\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/flatpak/flatpak/commit/1330662f33a55e88bfe18e76de28b7922d91a999\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/flatpak/flatpak/commit/26b12484eb8a6219b9e7aa287b298a894b2f34ca\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/flatpak/flatpak/commit/462fca2c666e0cd2b60d6d2593a7216a83047aaf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/flatpak/flatpak/commit/4c34815784e9ffda5733225c7d95824f96375e36\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/flatpak/flatpak/commit/89ae9fe74c6d445bb1b3a40e568d77cf5de47e48\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/flatpak/flatpak/commit/9766ee05b1425db397d2cf23afd24c7f6146a69f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/flatpak/flatpak/commit/a10f52a7565c549612c92b8e736a6698a53db330\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/flatpak/flatpak/commit/e26ac7586c392b5eb35ff4609fe232c52523b2cf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5656ONDP2MGKIJMKEC7N2NXCV27WGTC/\", \"name\": \"FEDORA-2021-4b201d15e6\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://www.debian.org/security/2021/dsa-4984\", \"name\": \"DSA-4984\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/10/26/9\", \"name\": \"[oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5DKCYRC6MFSTFCUP4DELCOUUP3SFEFX/\", \"name\": \"FEDORA-2021-c5a9c85737\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://security.gentoo.org/glsa/202312-12\", \"name\": \"GLSA-202312-12\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T02:59:31.388Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-41133\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-30T16:07:06.539565Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:flatpak:flatpak:1.10.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:flatpak:flatpak:1.11.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:flatpak:flatpak:1.8.0:*:*:*:*:*:*:*\"], \"vendor\": \"flatpak\", \"product\": \"flatpak\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.10.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.10.4\"}, {\"status\": \"affected\", \"version\": \"1.11.0\", \"lessThan\": \"1.12.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.8.0\", \"lessThan\": \"1.8.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*\"], \"vendor\": \"fedoraproject\", \"product\": \"fedora\", \"versions\": [{\"status\": \"affected\", \"version\": \"34\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\"], \"vendor\": \"fedoraproject\", \"product\": \"fedora\", \"versions\": [{\"status\": \"affected\", \"version\": \"33\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\"], \"vendor\": \"debian\", \"product\": \"debian_linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.0\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-30T16:11:33.580Z\"}}], \"cna\": {\"title\": \"Sandbox bypass via recent VFS-manipulating syscalls\", \"source\": {\"advisory\": \"GHSA-67h7-w3jq-vh4q\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"flatpak\", \"product\": \"flatpak\", \"versions\": [{\"status\": \"affected\", \"version\": \">= 1.8.0, <= 1.8.2\"}, {\"status\": \"affected\", \"version\": \">= 1.10.0, < 1.10.4\"}, {\"status\": \"affected\", \"version\": \">= 1.11.0, < 1.12.0\"}]}], \"references\": [{\"url\": \"https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q\"}, {\"url\": \"https://github.com/flatpak/flatpak/commit/1330662f33a55e88bfe18e76de28b7922d91a999\"}, {\"url\": \"https://github.com/flatpak/flatpak/commit/26b12484eb8a6219b9e7aa287b298a894b2f34ca\"}, {\"url\": \"https://github.com/flatpak/flatpak/commit/462fca2c666e0cd2b60d6d2593a7216a83047aaf\"}, {\"url\": \"https://github.com/flatpak/flatpak/commit/4c34815784e9ffda5733225c7d95824f96375e36\"}, {\"url\": \"https://github.com/flatpak/flatpak/commit/89ae9fe74c6d445bb1b3a40e568d77cf5de47e48\"}, {\"url\": \"https://github.com/flatpak/flatpak/commit/9766ee05b1425db397d2cf23afd24c7f6146a69f\"}, {\"url\": \"https://github.com/flatpak/flatpak/commit/a10f52a7565c549612c92b8e736a6698a53db330\"}, {\"url\": \"https://github.com/flatpak/flatpak/commit/e26ac7586c392b5eb35ff4609fe232c52523b2cf\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5656ONDP2MGKIJMKEC7N2NXCV27WGTC/\", \"name\": \"FEDORA-2021-4b201d15e6\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.debian.org/security/2021/dsa-4984\", \"name\": \"DSA-4984\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/10/26/9\", \"name\": \"[oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5DKCYRC6MFSTFCUP4DELCOUUP3SFEFX/\", \"name\": \"FEDORA-2021-c5a9c85737\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/202312-12\", \"name\": \"GLSA-202312-12\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20: Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-12-23T10:06:26.199973\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2021-41133\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-04T02:59:31.388Z\", \"dateReserved\": \"2021-09-15T00:00:00\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2021-10-08T00:00:00\", \"assignerShortName\": \"GitHub_M\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.