Vulnerability Name:

CVE-2021-43860 (CCN-217864)

Assigned:2021-11-16
Published:2022-01-12
Updated:2022-02-10
Summary:Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the *actual* metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.
CVSS v3 Severity:8.6 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
7.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.2 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)
7.1 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-276
CWE-863
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2021-43860

Source: XF
Type: UNKNOWN
flatpak-cve202143860-priv-esc(217864)

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/flatpak/flatpak/commit/54ec1a482dfc668127eaae57f135e6a8e0bc52da

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/flatpak/flatpak/commit/65cbfac982cb1c83993a9e19aa424daee8e9f042

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/flatpak/flatpak/commit/93357d357119093804df05acc32ff335839c6451

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/flatpak/flatpak/commit/ba818f504c926baaf6e362be8159cfacf994310e

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/flatpak/flatpak/commit/d9a8f9d8ccc0b7c1135d0ecde006a75d25f66aee

Source: MISC
Type: Release Notes, Third Party Advisory
https://github.com/flatpak/flatpak/releases/tag/1.10.6

Source: MISC
Type: Release Notes, Third Party Advisory
https://github.com/flatpak/flatpak/releases/tag/1.12.3

Source: CCN
Type: Flatpak GIT Repository
CVE-2021-43860: Permissions granted to applications can be hidden from the user at install time

Source: CONFIRM
Type: Patch, Third Party Advisory
https://github.com/flatpak/flatpak/security/advisories/GHSA-qpjc-vq3c-572j

Source: FEDORA
Type: Third Party Advisory
FEDORA-2022-825ca6bf2b

Source: DEBIAN
Type: Third Party Advisory
DSA-5049

Vulnerable Configuration:Configuration 1:
  • cpe:/a:flatpak:flatpak:*:*:*:*:*:*:*:* (Version < 1.10.6)
  • OR cpe:/a:flatpak:flatpak:*:*:*:*:*:*:*:* (Version >= 1.11.1 and <= 1.12.3)

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:35:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:11.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:flatpak:flatpak:1.12.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7885
    P
    		flatpak-1.14.4-150500.1.3 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:3268
    P
    		libtiff5-32bit-4.0.9-44.30.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94898
    P
    		flatpak-1.12.5-150400.1.11 on GA media (Moderate)
    2022-06-22
    oval:com.redhat.rhsa:def:20221792
    P
    		RHSA-2022:1792: flatpak security and bug fix update (Moderate)
    2022-05-10
    oval:org.opensuse.security:def:119015
    P
    		Security update for flatpak (Important)
    2022-03-04
    oval:org.opensuse.security:def:119688
    P
    		Security update for flatpak (Important)
    2022-03-04
    oval:org.opensuse.security:def:119126
    P
    		Security update for flatpak (Important)
    2022-03-04
    oval:org.opensuse.security:def:101767
    P
    		Security update for flatpak (Important)
    2022-03-04
    oval:org.opensuse.security:def:119320
    P
    		Security update for flatpak (Important)
    2022-03-04
    oval:org.opensuse.security:def:118825
    P
    		Security update for flatpak (Important)
    2022-03-04
    oval:org.opensuse.security:def:119503
    P
    		Security update for flatpak (Important)
    2022-03-04
    oval:org.opensuse.security:def:1089
    P
    		Security update for flatpak (Important)
    2022-03-04
    oval:org.opensuse.security:def:112242
    P
    		flatpak-1.12.3-1.1 on GA media (Moderate)
    2022-01-17
    BACK
    flatpak flatpak *
    flatpak flatpak *
    fedoraproject fedora 35
    redhat enterprise linux 8.0
    debian debian linux 9.0
    debian debian linux 10.0
    debian debian linux 11.0
    flatpak flatpak 1.12.2