CVE-2021-41133 Sandbox bypass via recent VFS-manipulating syscalls
Flatpak apps can bypass sandbox restrictions by manipulating the virtual filesystem to trick host services into granting elevated privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41133?
CVE-2021-41133 is a high-severity vulnerability in Debian Debian Linux, published on 8 Oct 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.
Weakness: CWE-20
Which versions are affected by CVE-2021-41133?
It affects 3 products.
Linux distribution packages (40)
flatpak AlmaLinux:8 | All versions | 1.8.5-4.el8_4 |
flatpak AlmaLinux:8 | All versions | 1.8.5-5.el8_5 |
flatpak-devel AlmaLinux:8 | All versions | 1.8.5-5.el8_5 |
flatpak-libs AlmaLinux:8 | All versions | 1.8.5-4.el8_4 |
flatpak-libs AlmaLinux:8 | All versions | 1.8.5-5.el8_5 |
flatpak-selinux AlmaLinux:8 | All versions | 1.8.5-4.el8_4 |
flatpak-selinux AlmaLinux:8 | All versions | 1.8.5-5.el8_5 |
flatpak-session-helper AlmaLinux:8 | All versions | 1.8.5-4.el8_4 |
flatpak-session-helper AlmaLinux:8 | All versions | 1.8.5-5.el8_5 |
flatpak Red Hat:enterprise_linux:7::client | All versions | 0:1.0.9-12.el7_9 |
flatpak-builder Red Hat:enterprise_linux:7::client | All versions | 0:1.0.0-12.el7_9 |
flatpak-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:1.0.9-12.el7_9 |
flatpak-devel Red Hat:enterprise_linux:7::client | All versions | 0:1.0.9-12.el7_9 |
flatpak-libs Red Hat:enterprise_linux:7::client | All versions | 0:1.0.9-12.el7_9 |
flatpak Red Hat:enterprise_linux:7::computenode | All versions | 0:1.0.9-12.el7_9 |
flatpak-builder Red Hat:enterprise_linux:7::computenode | All versions | 0:1.0.0-12.el7_9 |
flatpak-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:1.0.9-12.el7_9 |
flatpak-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:1.0.9-12.el7_9 |
flatpak-libs Red Hat:enterprise_linux:7::computenode | All versions | 0:1.0.9-12.el7_9 |
flatpak Red Hat:enterprise_linux:7::server | All versions | 0:1.0.9-12.el7_9 |
flatpak-builder Red Hat:enterprise_linux:7::server | All versions | 0:1.0.0-12.el7_9 |
flatpak-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1.0.9-12.el7_9 |
flatpak-devel Red Hat:enterprise_linux:7::server | All versions | 0:1.0.9-12.el7_9 |
flatpak-libs Red Hat:enterprise_linux:7::server | All versions | 0:1.0.9-12.el7_9 |
flatpak Red Hat:enterprise_linux:7::workstation | All versions | 0:1.0.9-12.el7_9 |
flatpak-builder Red Hat:enterprise_linux:7::workstation | All versions | 0:1.0.0-12.el7_9 |
flatpak-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:1.0.9-12.el7_9 |
flatpak-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:1.0.9-12.el7_9 |
flatpak-libs Red Hat:enterprise_linux:7::workstation | All versions | 0:1.0.9-12.el7_9 |
flatpak Red Hat:enterprise_linux:8::appstream | All versions | 0:1.8.5-4.el8_4 |
flatpak-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.8.5-4.el8_4 |
flatpak-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.8.5-4.el8_4 |
flatpak-libs Red Hat:enterprise_linux:8::appstream | All versions | 0:1.8.5-4.el8_4 |
flatpak-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.8.5-4.el8_4 |
flatpak-selinux Red Hat:enterprise_linux:8::appstream | All versions | 0:1.8.5-4.el8_4 |
flatpak-session-helper Red Hat:enterprise_linux:8::appstream | All versions | 0:1.8.5-4.el8_4 |
flatpak-session-helper-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.8.5-4.el8_4 |
flatpak-tests-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.8.5-4.el8_4 |
flatpak Red Hat:rhel_eus:8.1::appstream | All versions | 0:1.0.9-5.el8_1 |
flatpak-debuginfo Red Hat:rhel_eus:8.1::appstream | All versions | 0:1.0.9-5.el8_1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Flatpak Flatpak.
How do I fix CVE-2021-41133?
Upgrade to a fixed version.
Is CVE-2021-41133 being exploited?
There is no known exploitation of CVE-2021-41133 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALEA-2021:4539, ALSA-2021:4042, CLEANSTART-2024-JX19003, DEBIAN-CVE-2021-41133, DSA-4984-1, GHSA-67h7-w3jq-vh4q and 14 more.