Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 831087 (CVE-2021-43860, CVE-2022-21682) - <sys-apps/flatpak-{1.10.6, 1.12.3}: multiple vulnerabilities
Summary: <sys-apps/flatpak-{1.10.6, 1.12.3}: multiple vulnerabilities
Status: IN_PROGRESS
Alias: CVE-2021-43860, CVE-2022-21682
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://github.com/flatpak/flatpak/se...
Whiteboard: B4 [glsa?]
Keywords:
Depends on: 831266
Blocks:
  Show dependency tree
 
Reported: 2022-01-12 22:24 UTC by John Helmert III
Modified: 2022-01-21 01:02 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III gentoo-dev Security 2022-01-12 22:24:30 UTC
CVE-2021-43860 (from URL):

"Ryan Gonzalez discovered that Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user."

Fix in 1.10.6, 1.12.3.
Comment 1 Larry the Git Cow gentoo-dev 2022-01-13 04:23:55 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d4b29f0c9489bbeddeff88ec2a8b445b9859fb68

commit d4b29f0c9489bbeddeff88ec2a8b445b9859fb68
Author:     Zac Medico <zmedico@gentoo.org>
AuthorDate: 2022-01-13 04:16:48 +0000
Commit:     Zac Medico <zmedico@gentoo.org>
CommitDate: 2022-01-13 04:23:50 +0000

    sys-apps/flatpak: Bump to version 1.10.6
    
    Bug: https://bugs.gentoo.org/831087
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Zac Medico <zmedico@gentoo.org>

 sys-apps/flatpak/Manifest              |   1 +
 sys-apps/flatpak/flatpak-1.10.6.ebuild | 102 +++++++++++++++++++++++++++++++++
 2 files changed, 103 insertions(+)
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-01-13 04:38:56 UTC
https://bugs.gentoo.org/8310#c4 too :)

Please stable when ready, thanks!
Comment 3 John Helmert III gentoo-dev Security 2022-01-13 23:39:30 UTC
CVE-2022-21682 (https://github.com/flatpak/flatpak/security/advisories/GHSA-8ch7-5j3h-g4fx):

Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.