Bugzilla – Bug 1194610
VUL-0: CVE-2021-43860: flatpak: Permissions granted to applications can be hidden from the user at install time
Last modified: 2022-10-13 06:33:26 UTC
CVE-2021-43860: Permissions granted to applications can be hidden from the user at install time Affected versions: all <= 1.12.2 Patched versions: 1.12.3, 1.10.6 Description: Ryan Gonzalez discovered that Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the actual metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from before the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. Maliciously crafted apps can use this to give themselves hidden permissions. In addition, a similar weakness was discovered, where if the permissions in the summary metadata are invalid, they would not be displayed to the user, but the the actual permissions would be granted, even though it didn't match the invalid version. Impact Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. Patches https://github.com/flatpak/flatpak/commit/ba818f504c926baaf6e362be8159cfacf994310e https://github.com/flatpak/flatpak/commit/d9a8f9d8ccc0b7c1135d0ecde006a75d25f66aee https://github.com/flatpak/flatpak/commit/93357d357119093804df05acc32ff335839c6451 https://github.com/flatpak/flatpak/commit/65cbfac982cb1c83993a9e19aa424daee8e9f042 unit test: https://github.com/flatpak/flatpak/commit/54ec1a482dfc668127eaae57f135e6a8e0bc52da Workarounds Users can manually check the permissions of installed apps by running flatpak info --show-permissions APP or checking the metadata file manually. For more information References: https://github.com/flatpak/flatpak/security/advisories/GHSA-qpjc-vq3c-572j https://github.com/flatpak/flatpak/releases/tag/1.12.3
Factory: https://build.opensuse.org/request/show/945939
The code in older codestreams is quite different, but going off of version numbers, it seems that these are affected: - SUSE:SLE-15:Update - SUSE:SLE-15-SP1:Update - SUSE:SLE-15-SP2:Update - SUSE:SLE-15-SP4:Update
SUSE-SU-2022:0712-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1194610,1194611 CVE References: CVE-2021-43860,CVE-2022-21682 JIRA References: Sources used: SUSE Manager Server 4.1 (src): flatpak-1.10.7-4.12.1 SUSE Manager Retail Branch Server 4.1 (src): flatpak-1.10.7-4.12.1 SUSE Manager Proxy 4.1 (src): flatpak-1.10.7-4.12.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): flatpak-1.10.7-4.12.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): flatpak-1.10.7-4.12.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): flatpak-1.10.7-4.12.1 SUSE Linux Enterprise Realtime Extension 15-SP2 (src): flatpak-1.10.7-4.12.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src): flatpak-1.10.7-4.12.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): flatpak-1.10.7-4.12.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): flatpak-1.10.7-4.12.1 SUSE Enterprise Storage 7 (src): flatpak-1.10.7-4.12.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2022:0712-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1194610,1194611 CVE References: CVE-2021-43860,CVE-2022-21682 JIRA References: Sources used: openSUSE Leap 15.3 (src): flatpak-1.10.7-4.12.1
still missing for - SUSE:SLE-15:Update/flatpak - SUSE:SLE-15-SP1:Update/flatpak please submit
SUSE-SU-2022:3284-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1191507,1194610 CVE References: CVE-2021-21261,CVE-2021-41133,CVE-2021-43860 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): flatpak-1.2.3-150100.4.8.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): flatpak-1.2.3-150100.4.8.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): flatpak-1.2.3-150100.4.8.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): flatpak-1.2.3-150100.4.8.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): flatpak-1.2.3-150100.4.8.1 SUSE Enterprise Storage 6 (src): flatpak-1.2.3-150100.4.8.1 SUSE CaaS Platform 4.0 (src): flatpak-1.2.3-150100.4.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.