PublicDateAtUSN: 2021-03-11 17:15:00 UTC
Candidate: CVE-2021-21381
PublicDate: 2021-03-11 17:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21381
 https://github.com/flatpak/flatpak/issues/4146
 https://github.com/flatpak/flatpak/security/advisories/GHSA-xgh4-387p-hqpp
 https://github.com/flatpak/flatpak/commit/8279c5818425b6812523e3805bbe242fb6a5d961
 https://github.com/flatpak/flatpak/commit/a7401e638bf0c03102039e216ab1081922f140ae
 https://github.com/flatpak/flatpak/commit/eb7946bb6248923d8c90fe9b84425fef97ae580d
 https://github.com/flatpak/flatpak/pull/4156
 https://github.com/flatpak/flatpak/releases/tag/1.10.2
 https://ubuntu.com/security/notices/USN-4951-1
Description:
 Flatpak is a system for building, distributing, and running sandboxed
 desktop applications on Linux. In Flatpack since version 0.9.4 and before
 version 1.10.2 has a vulnerability in the "file forwarding" feature which
 can be used by an attacker to gain access to files that would not
 ordinarily be allowed by the app's permissions. By putting the special
 tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop
 file, a malicious app publisher can trick flatpak into behaving as though
 the user had chosen to open a target file with their Flatpak app, which
 automatically makes that file available to the Flatpak app. This is fixed
 in version 1.10.2. A minimal solution is the first commit "`Disallow @@ and
 @@U usage in desktop files`". The follow-up commits "`dir: Reserve the
 whole @@ prefix`" and "`dir: Refuse to export .desktop files with
 suspicious uses of @@ tokens`" are recommended, but not strictly required.
 As a workaround, avoid installing Flatpak apps from untrusted sources, or
 check the contents of the exported `.desktop` files in
 `exports/share/applications/*.desktop` (typically
 `~/.local/share/flatpak/exports/share/applications/*.desktop` and
 `/var/lib/flatpak/exports/share/applications/*.desktop`) to make sure that
 literal filenames do not follow `@@` or `@@u`.
Ubuntu-Description:
 Anton Lydike discovered that Flatpak did not properly handle special
 tokens in desktop files. An attacker could use this to specially
 craft a Flatpak application that could escape sandbox confinement.
Notes:
Mitigation:
Bugs:
 https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/1918482
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=984859
Priority: medium
Discovered-by: Anton Lydike
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N [8.2 HIGH]


Patches_flatpak:
upstream_flatpak: released (1.10.1-4)
precise/esm_flatpak: DNE
trusty_flatpak: ignored (out of standard support)
trusty/esm_flatpak: DNE
xenial_flatpak: DNE
bionic_flatpak: released (1.0.9-0ubuntu0.3)
focal_flatpak: released (1.6.5-0ubuntu0.3)
groovy_flatpak: released (1.8.2-1ubuntu0.2)
hirsute_flatpak: not-affected (1.10.2-1)
devel_flatpak: not-affected (1.10.2-1)