8.8

CVE-2021-41133: debian debian_linux Improper Input Validation

CVSS: 8.8v3.1HighModified
AliasesMGASA-2021-0486SUSE-SU-2021:3472-1SUSE-SU-2022:3439-1
Published 08-10-2021Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2021-41133 is a high (CVSS 8.8) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.5% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.44%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
SUSE-SU-2022:3284-1

Timeline

  1. 08-10-2021
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

0.00 pp

From 0.44% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat11 products
  • flatpak< 0:1.8.5-4.el8_4 | < 0:1.0.9-12.el7_9 | < 0:1.0.9-5.el8_1 | < 0:1.6.2-6.el8_2
  • flatpak-builder< 0:1.0.0-12.el7_9
  • flatpak-debuginfo< 0:1.8.5-4.el8_4 | < 0:1.0.9-12.el7_9 | < 0:1.0.9-5.el8_1 | < 0:1.6.2-6.el8_2
  • flatpak-debugsource< 0:1.8.5-4.el8_4 | < 0:1.0.9-5.el8_1 | < 0:1.6.2-6.el8_2
  • flatpak-devel< 0:1.0.9-12.el7_9
Suse6 products
  • flatpak&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 0.10.4-150000.4.13.1
  • flatpak&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 0.10.4-150000.4.13.1
  • flatpak&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP2< 1.10.5-4.9.1
  • flatpak&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP3< 1.10.5-4.9.1
  • flatpak&distro=SUSE Linux Enterprise Server 15-LTSS< 0.10.4-150000.4.13.1
Opensuse3 products
  • flatpak&distro=openSUSE Leap 15.2< 1.10.5-lp152.3.9.1
  • flatpak&distro=openSUSE Leap 15.3< 1.10.5-4.9.1
  • flatpak&distro=openSUSE Tumbleweed< 1.12.1-1.1
Debian2 products
Fedoraproject1 product
Flatpak1 product
  • flatpak≥ 1.8.0, ≤ 1.8.2 | ≥ 1.11.0, < 1.12.0 | < 1.8.2 | ≥ 1.10.0, < 1.10.4 | ≥ 1.11.1, < 1.12.1
Mageia1 product
  • flatpak< 1.10.5-1.mga8
Ubuntu1 product
  • flatpak< 1.0.9-0ubuntu0.4 | < 1.6.5-0ubuntu0.4

8 vendors · 26 products

References

39 links
Show all 39 references