CVE-2021-41133

CWE-20 — Improper Input Validation7 documents6 sources
Severity
7.8HIGH
EPSS
0.1%
top 81.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Flatpak FlatpakDebian Debian LinuxFedoraproject Fedora
Timeline
PublishedOct 8
Latest updateDec 14

Description

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's den…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 2.0 | Impact: 6.0

Affected Packages3 packages

▶NVDflatpak/flatpak1.10.0 — 1.10.4+2
▶Debianflatpak< 1.10.5-0+deb11u1+3
▶CVEListV5flatpak/flatpak>= 1.10.0, < 1.10.4, >= 1.11.0, < 1.12.0, >= 1.8.0, <= 1.8.2+2

Also affects: Debian Linux 11.0, Fedora 33, 34

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
OSV
CVE-2021-41133: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux↗2021-10-08
▶
CVEList
Sandbox bypass via recent VFS-manipulating syscalls↗2021-10-08
▶

📋Vendor Advisories

4
Ubuntu
Flatpak vulnerability↗2021-12-14
▶
Red Hat
webkitgtk: limited sandbox escape via VFS syscalls↗2021-10-20
▶
Red Hat
flatpak: Sandbox bypass via recent VFS-manipulating syscalls↗2021-10-08
▶
Debian
CVE-2021-41133: flatpak - Flatpak is a system for building, distributing, and running sandboxed desktop ap...↗2021
▶
CVE-2021-41133 (HIGH CVSS 7.8) | Flatpak is a system for building | cvebase.io