Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.

The remote host is affected by the vulnerability described in GLSA-202312-12 (Flatpak: Multiple Vulnerabilities)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the file forwarding     feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by     the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak     app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had     chosen to open a target file with their Flatpak app, which automatically makes that file available to the     Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit `Disallow @@ and @@U     usage in desktop files`. The follow-up commits `dir: Reserve the whole @@ prefix` and `dir: Refuse to     export .desktop files with suspicious uses of @@ tokens` are recommended, but not strictly required. As a     workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported     `.desktop` files in `exports/share/applications/*.desktop` (typically     `~/.local/share/flatpak/exports/share/applications/*.desktop` and     `/var/lib/flatpak/exports/share/applications/*.desktop`) to make sure that literal filenames do not follow     `@@` or `@@u`. (CVE-2021-21381)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6,     Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time     match the actual permissions granted to the app at runtime, in the case that there's a null byte in the     metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user.
    Flatpak shows permissions to the user during install by reading them from the xa.metadata key in the     commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak     compares these permissions to the *actual* metadata, from the metadata file to ensure it wasn't lied to.
    However, the actual metadata contents are loaded in several places where they are read as simple C-style     strings. That means that, if the metadata file includes a null terminator, only the content of the file     from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the     metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously     crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted     sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an     update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the     permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.
    (CVE-2021-43860)

  - Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability     affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the     build. At this point the build directory will have the full access that is specified in the manifest, so     running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is     not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch     `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead     to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these     empty directories can be created wherever the user has write permissions. However, a malicious application     could replace the `appstream-util` binary and potentially do something more hostile. This has been     resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and     `--nofilesystem=host`. (CVE-2022-21682)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2076 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has flatpak packages installed that are affected by a vulnerability:

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3439-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3284-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug     was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary     code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and     before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by     its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their     own subprocesses in a new sandbox instance, either with the same security settings as the caller or with     more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as     Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a     more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service     passes caller-specified environment variables to non-sandboxed processes on the host system, and in     particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or     compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and     use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be     mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many     Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0. (CVE-2021-21261)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6,     Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time     match the actual permissions granted to the app at runtime, in the case that there's a null byte in the     metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user.
    Flatpak shows permissions to the user during install by reading them from the xa.metadata key in the     commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak     compares these permissions to the *actual* metadata, from the metadata file to ensure it wasn't lied to.
    However, the actual metadata contents are loaded in several places where they are read as simple C-style     strings. That means that, if the metadata file includes a null terminator, only the content of the file     from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the     metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously     crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted     sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an     update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the     permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.
    (CVE-2021-43860)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4042 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4042 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the flatpak packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5191-1 advisory.

    It was discovered that Flatpak incorrectly handled certain AF_UNIX sockets. An attacker could use this to     specially craft a Flatpak application that could escape sandbox confinement.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4044 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4106 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Sandbox bypass via recent VFS-manipulating syscalls (CVE-2021-41133)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4042 advisory.

  - flatpak: Sandbox bypass via recent VFS-manipulating syscalls (CVE-2021-41133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4107 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Sandbox bypass via recent VFS-manipulating syscalls (CVE-2021-41133)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4044 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Sandbox bypass via recent VFS-manipulating syscalls (CVE-2021-41133)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4042 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Sandbox bypass via recent VFS-manipulating syscalls (CVE-2021-41133)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:4044-1 advisory.

  - flatpak: Sandbox bypass via recent VFS-manipulating syscalls (CVE-2021-41133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4042 advisory.

    [1.8.5-4]
    - Fix CVE-2021-41133 (#2012867)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4044 advisory.

    [1.0.9-12]
    - Fix CVE-2021-41133 (#2012864)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1400-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3472-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:3472-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-4984 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
187282	GLSA-202312-12 : Flatpak: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
176897	Amazon Linux 2 : flatpak (ALAS-2023-2076)	Nessus	Amazon Linux Local Security Checks	high
174082	NewStart CGSL CORE 5.05 / MAIN 5.05 : flatpak Vulnerability (NS-SA-2023-0012)	Nessus	NewStart CGSL Local Security Checks	high
165561	SUSE SLES15 Security Update : flatpak (SUSE-SU-2022:3439-1)	Nessus	SuSE Local Security Checks	high
165227	SUSE SLES15 Security Update : flatpak (SUSE-SU-2022:3284-1)	Nessus	SuSE Local Security Checks	high
157751	Rocky Linux 8 : flatpak (RLSA-2021:4042)	Nessus	Rocky Linux Local Security Checks	high
157576	AlmaLinux 8 : flatpak (ALSA-2021:4042)	Nessus	Alma Linux Local Security Checks	high
156294	EulerOS 2.0 SP8 : flatpak (EulerOS-SA-2021-2799)	Nessus	Huawei Local Security Checks	high
156055	Ubuntu 18.04 LTS / 20.04 LTS : Flatpak vulnerability (USN-5191-1)	Nessus	Ubuntu Local Security Checks	high
155550	CentOS 7 : flatpak (RHSA-2021:4044)	Nessus	CentOS Local Security Checks	high
154893	RHEL 8 : flatpak (RHSA-2021:4106)	Nessus	Red Hat Local Security Checks	high
154872	CentOS 8 : flatpak (CESA-2021:4042)	Nessus	CentOS Local Security Checks	high
154854	RHEL 8 : flatpak (RHSA-2021:4107)	Nessus	Red Hat Local Security Checks	high
154838	RHEL 7 : flatpak (RHSA-2021:4044)	Nessus	Red Hat Local Security Checks	high
154831	RHEL 8 : flatpak (RHSA-2021:4042)	Nessus	Red Hat Local Security Checks	high
154823	Scientific Linux Security Update : flatpak on SL7.x x86_64 (2021:4044)	Nessus	Scientific Linux Local Security Checks	high
154782	Oracle Linux 8 : flatpak (ELSA-2021-4042)	Nessus	Oracle Linux Local Security Checks	high
154780	Oracle Linux 7 : flatpak (ELSA-2021-4044)	Nessus	Oracle Linux Local Security Checks	high
154759	openSUSE 15 Security Update : flatpak (openSUSE-SU-2021:1400-1)	Nessus	SuSE Local Security Checks	high
154305	SUSE SLED15 / SLES15 Security Update : flatpak (SUSE-SU-2021:3472-1)	Nessus	SuSE Local Security Checks	high
154283	openSUSE 15 Security Update : flatpak (openSUSE-SU-2021:3472-1)	Nessus	SuSE Local Security Checks	high
154148	Debian DSA-4984-1 : flatpak - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-41133

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high