Bug 1194610 - (CVE-2021-43860) VUL-0: CVE-2021-43860: flatpak: Permissions granted to applications can be hidden from the user at install time
(CVE-2021-43860)
VUL-0: CVE-2021-43860: flatpak: Permissions granted to applications can be hi...
Status: RESOLVED FIXED
Classification: openSUSE
Product: openSUSE Distribution
Classification: openSUSE
Component: Security
Leap 15.3
Other Other
: P3 - Medium : Major (vote)
: ---
Assigned To: Michael Gorse
https://smash.suse.de/issue/320226/
CVSSv3.1:SUSE:CVE-2021-43860:8.2:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-01-12 20:34 UTC by Andreas Stieger
Modified: 2022-10-13 06:33 UTC (History)
6 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---
mgorse: needinfo? (mgorse)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2022-01-12 20:34:21 UTC
CVE-2021-43860: Permissions granted to applications can be hidden from the user at install time

Affected versions: all <= 1.12.2
Patched versions:  1.12.3, 1.10.6

Description: Ryan Gonzalez discovered that Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user.

Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the actual metadata, from the "metadata" file to ensure it wasn't lied to.

However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from before the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. Maliciously crafted apps can use this to give themselves hidden permissions.

In addition, a similar weakness was discovered, where if the permissions in the summary metadata are invalid, they would not be displayed to the user, but the the actual permissions would be granted, even though it didn't match the invalid version.
Impact

Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update.

Patches

https://github.com/flatpak/flatpak/commit/ba818f504c926baaf6e362be8159cfacf994310e
https://github.com/flatpak/flatpak/commit/d9a8f9d8ccc0b7c1135d0ecde006a75d25f66aee
https://github.com/flatpak/flatpak/commit/93357d357119093804df05acc32ff335839c6451
https://github.com/flatpak/flatpak/commit/65cbfac982cb1c83993a9e19aa424daee8e9f042

unit test: https://github.com/flatpak/flatpak/commit/54ec1a482dfc668127eaae57f135e6a8e0bc52da


Workarounds

Users can manually check the permissions of installed apps by running flatpak info --show-permissions APP or checking the metadata file manually.
For more information


References:
https://github.com/flatpak/flatpak/security/advisories/GHSA-qpjc-vq3c-572j
https://github.com/flatpak/flatpak/releases/tag/1.12.3
Comment 1 Andreas Stieger 2022-01-12 21:40:29 UTC
Factory: https://build.opensuse.org/request/show/945939
Comment 5 Carlos López 2022-01-19 14:48:21 UTC
The code in older codestreams is quite different, but going off of version numbers, it seems that these are affected:
 - SUSE:SLE-15:Update
 - SUSE:SLE-15-SP1:Update
 - SUSE:SLE-15-SP2:Update
 - SUSE:SLE-15-SP4:Update
Comment 6 Swamp Workflow Management 2022-03-04 14:20:07 UTC
SUSE-SU-2022:0712-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1194610,1194611
CVE References: CVE-2021-43860,CVE-2022-21682
JIRA References: 
Sources used:
SUSE Manager Server 4.1 (src):    flatpak-1.10.7-4.12.1
SUSE Manager Retail Branch Server 4.1 (src):    flatpak-1.10.7-4.12.1
SUSE Manager Proxy 4.1 (src):    flatpak-1.10.7-4.12.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    flatpak-1.10.7-4.12.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    flatpak-1.10.7-4.12.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    flatpak-1.10.7-4.12.1
SUSE Linux Enterprise Realtime Extension 15-SP2 (src):    flatpak-1.10.7-4.12.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src):    flatpak-1.10.7-4.12.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    flatpak-1.10.7-4.12.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    flatpak-1.10.7-4.12.1
SUSE Enterprise Storage 7 (src):    flatpak-1.10.7-4.12.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Swamp Workflow Management 2022-03-04 14:32:37 UTC
openSUSE-SU-2022:0712-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1194610,1194611
CVE References: CVE-2021-43860,CVE-2022-21682
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    flatpak-1.10.7-4.12.1
Comment 8 Robert Frohl 2022-08-02 13:22:36 UTC
still missing for 

- SUSE:SLE-15:Update/flatpak
- SUSE:SLE-15-SP1:Update/flatpak

please submit
Comment 11 Swamp Workflow Management 2022-09-15 19:19:56 UTC
SUSE-SU-2022:3284-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1191507,1194610
CVE References: CVE-2021-21261,CVE-2021-41133,CVE-2021-43860
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    flatpak-1.2.3-150100.4.8.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    flatpak-1.2.3-150100.4.8.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    flatpak-1.2.3-150100.4.8.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    flatpak-1.2.3-150100.4.8.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    flatpak-1.2.3-150100.4.8.1
SUSE Enterprise Storage 6 (src):    flatpak-1.2.3-150100.4.8.1
SUSE CaaS Platform 4.0 (src):    flatpak-1.2.3-150100.4.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.