CVE-2021-21261

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the flatpak-portal service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.9.4. The Flatpak portal D-Bus service (flatpak-portal, also known by its D-Bus service name org.freedesktop.portal.Flatpak) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the flatpak run command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the flatpak run command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the flatpak-portal service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.9.4.(CVE-2021-21261)

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the flatpak-portal service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (flatpak-portal, also known by its D-Bus service name org.freedesktop.portal.Flatpak) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the flatpak run command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the flatpak run command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the flatpak-portal service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0.

Sandbox escape where a malicious application can execute code outside the sandbox by controlling the environment of the "flatpak run" command when spawning a sub-sandbox (CVE-2021-21261).

A potential attack where a flatpak application could use custom formatted .desktop files to gain access to files on the host system (CVE-2021-21381).

The update also removes the unnecessary flatpak-tests subpackage.

This update for flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk fixes the following issues:

libostree:

Update to version 2020.8

• Enable LTO. (bsc#1133120)

• This update contains scalability improvements and bugfixes.

• Caching-related HTTP headers are now supported on summaries and signatures, so that they do not have to be re-downloaded if not changed in the meanwhile.

• Summaries and delta have been reworked to allow more fine-grained fetching.

• Fixes several bugs related to atomic variables, HTTP timeouts, and 32-bit architectures.

• Static deltas can now be signed to more easily support offline verification.

• There's now support for multiple initramfs images; Is it possible to have a 'main' initramfs image and a secondary one which represents local configuration.

• The documentation is now moved to https://ostreedev.github.io/ostree/

• Fix for an assertion failure when upgrading from systems before ostree supported devicetree.

• ostree no longer hardlinks zero sized files to avoid hitting filesystem maximum link counts.

• ostree now supports / and /boot being on the same filesystem.

• Improvements to the GObject Introspection metadata, some (cosmetic) static analyzer fixes, a fix for the immutable bit on s390x, dropping a deprecated bit in the systemd unit file.

• Fix a regression 2020.4 where the 'readonly sysroot' changes incorrectly left the sysroot read-only on systems that started out with a read-only / (most of them, e.g. Fedora Silverblue/IoT at least).

• The default dracut config now enables reproducibility.

• There is a new ostree admin unlock --transient. This should to be a foundation for further support for 'live' updates.

• New ed25519 signing support, powered by libsodium.

• stree commit gained a new --base argument, which significantly simplifies constructing 'derived' commits, particularly for systems using SELinux.

• Handling of the read-only sysroot was reimplemented to run in the initramfs and be more reliable. Enabling the readonly=true flag in the repo config is recommended.

• Several fixes in locking for the temporary 'staging' directories OSTree creates, particularly on NFS.

• A new timestamp-check-from-rev option was added for pulls, which makes downgrade protection more reliable and will be used by Fedora CoreOS.

• Several fixes and enhancements made for 'collection' pulls including a new --mirror option.

• The ostree commit command learned a new --mode-ro-executables which enforces W^R semantics on all executables.

• Added a new commit metadata key OSTREE_COMMIT_META_KEY_ARCHITECTURE to help standardize the architecture of the OSTree commit. This could be used on the client side for example to sanity-check that the commit matches the architecture of the machine before deploying.

• Stop invalid usage of %_libexecdir:

  • Use %{_prefix}/lib where appropriate.
  • Use _systemdgeneratordir for the systemd-generators.
  • Define _dracutmodulesdir based on dracut.pc. Add BuildRequires(dracut) for this to work.

xdg-desktop-portal:

Update to version 1.8.0:

• Ensure systemd rpm macros are called at install/uninstall times for systemd user services.
• Add BuildRequires on systemd-rpm-macros.
• openuri:
  • Allow skipping the chooser for more URL tyles
  • Robustness fixes
• filechooser:
  • Return the current filter
  • Add a 'directory' option
  • Document the 'writable' option
• camera:
  • Make the client node visible
  • Don't leak pipewire proxy
• Fix file descriptor leaks
• Testsuite improvements
• Updated translations.
• document:
  • Reduce the use of open fds
  • Add more tests and fix issues they found
  • Expose directories with their proper name
  • Support exporting directories
  • New fuse implementation
• background: Avoid a segfault
• screencast: Require pipewire 0.3
• Better support for snap and toolbox
• Require /usr/bin/fusermount: xdg-document-portal calls out to the binary. (bsc#1175899)…

These are all security issues fixed in the flatpak-1.11.3-1.2 package on the GA media of openSUSE Tumbleweed.

This update for flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk fixes the following issues:

libostree:

Update to version 2020.8

• Enable LTO. (bsc#1133120)

• This update contains scalability improvements and bugfixes.

• Caching-related HTTP headers are now supported on summaries and signatures, so that they do not have to be re-downloaded if not changed in the meanwhile.

• Summaries and delta have been reworked to allow more fine-grained fetching.

• Fixes several bugs related to atomic variables, HTTP timeouts, and 32-bit architectures.

• Static deltas can now be signed to more easily support offline verification.

• There's now support for multiple initramfs images; Is it possible to have a 'main' initramfs image and a secondary one which represents local configuration.

• The documentation is now moved to https://ostreedev.github.io/ostree/

• Fix for an assertion failure when upgrading from systems before ostree supported devicetree.

• ostree no longer hardlinks zero sized files to avoid hitting filesystem maximum link counts.

• ostree now supports / and /boot being on the same filesystem.

• Improvements to the GObject Introspection metadata, some (cosmetic) static analyzer fixes, a fix for the immutable bit on s390x, dropping a deprecated bit in the systemd unit file.

• Fix a regression 2020.4 where the 'readonly sysroot' changes incorrectly left the sysroot read-only on systems that started out with a read-only / (most of them, e.g. Fedora Silverblue/IoT at least).

• The default dracut config now enables reproducibility.

• There is a new ostree admin unlock --transient. This should to be a foundation for further support for 'live' updates.

• New ed25519 signing support, powered by libsodium.

• stree commit gained a new --base argument, which significantly simplifies constructing 'derived' commits, particularly for systems using SELinux.

• Handling of the read-only sysroot was reimplemented to run in the initramfs and be more reliable. Enabling the readonly=true flag in the repo config is recommended.

• Several fixes in locking for the temporary 'staging' directories OSTree creates, particularly on NFS.

• A new timestamp-check-from-rev option was added for pulls, which makes downgrade protection more reliable and will be used by Fedora CoreOS.

• Several fixes and enhancements made for 'collection' pulls including a new --mirror option.

• The ostree commit command learned a new --mode-ro-executables which enforces W^R semantics on all executables.

• Added a new commit metadata key OSTREE_COMMIT_META_KEY_ARCHITECTURE to help standardize the architecture of the OSTree commit. This could be used on the client side for example to sanity-check that the commit matches the architecture of the machine before deploying.

• Stop invalid usage of %_libexecdir:

  • Use %{_prefix}/lib where appropriate.
  • Use _systemdgeneratordir for the systemd-generators.
  • Define _dracutmodulesdir based on dracut.pc. Add BuildRequires(dracut) for this to work.

xdg-desktop-portal:

Update to version 1.8.0:

• Ensure systemd rpm macros are called at install/uninstall times for systemd user services.
• Add BuildRequires on systemd-rpm-macros.
• openuri:
  • Allow skipping the chooser for more URL tyles
  • Robustness fixes
• filechooser:
  • Return the current filter
  • Add a 'directory' option
  • Document the 'writable' option
• camera:
  • Make the client node visible
  • Don't leak pipewire proxy
• Fix file descriptor leaks
• Testsuite improvements
• Updated translations.
• document:
  • Reduce the use of open fds
  • Add more tests and fix issues they found
  • Expose directories with their proper name
  • Support exporting directories
  • New fuse implementation
• background: Avoid a segfault
• screencast: Require pipewire 0.3
• Better support for snap and toolbox
• Require /usr/bin/fusermount: xdg-document-portal calls out to the binary. (bsc#1175899)…

This update for flatpak fixes the following issues:

• CVE-2021-21381: Fixed an issue where a sandboxed application could read and write arbitrary host files via special tokens in the .desktop file (bsc#1183459).
• CVE-2021-21261: Fixed a sandbox escape issue via the flatpak-portal service (bsc#1180996).

Non-security fixes:

• openh264 extension needs to use 'extra_data'. (bsc#1155688) The update will provide the support for extra_data' in extensions and will provide a list of versions that are supported. This will be useful for the extra_data for extensions because that will require it to say that it is supported for version > 1.2.5 in the 1.2 series and > 1.4.2 otherwise. The update will includes fixes for a segfault in the function that lists the installed references (flatpak_installation_list_installed_refs). When an appstream update is cancelled while downloading icons, the update will show a proper fail. Before this fix the next update attempt will see an up-to-date timestamp, think everyhing is ok and not download the missing icons. The update will introduce checks in the OCI (Open Container Initiative format) updates for validating if it is gpg verified. The update will install the required runtime for the installed extension. The update will prevent a crash if the 'FlatpakDir' can't ensure it has a repo configured. The update will prevent the removal of local extensions considered remote and not locally related.

This update for flatpak fixes the following issues:

• CVE-2021-41133: Fixed sandbox bypass via recent syscalls (bsc#1191507).
• CVE-2021-43860: Fixed metadata validation (bsc#1194610).

Simon McVittie discovered that flatpak-portal service allowed sandboxed applications to execute arbitrary code on the host system (a sandbox escape). A malicious user could create a Flatpak application that set environment variables, trusted by the Flatpak "run" command, and use it to execute arbitrary code outside the sandbox.