Detections
Analytics

GLSA-202101-21 : Flatpak: Sandbox escape

high Nessus Plugin ID 145369

Language:

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-202101-21 (Flatpak: Sandbox escape)

 A bug was discovered in the flatpak-portal service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape).
 Impact :

 A remote attacker could entice a user to open a specially crafted Flatpak app possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
 Workaround :

 As a workaround, this vulnerability can be mitigated by preventing the flatpak-portal service from starting, but that mitigation will prevent many Flatpak apps from working correctly. It is highly recommended to upgrade.

Solution

All Flatpak users should upgrade to the latest version:
 # emerge --sync # emerge --ask --oneshot --verbose '>=sys-apps/flatpak-1.10.0'

See Also

https://security.gentoo.org/glsa/202101-21

Plugin Details

Severity: High

ID: 145369

File Name: gentoo_GLSA-202101-21.nasl

Version: 1.3

Type: local

Published: 1/25/2021

Updated: 1/29/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.5

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2021-21261

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:gentoo:linux, p-cpe:/a:gentoo:linux:flatpak

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Ease: No known exploits are available

Patch Publication Date: 1/25/2021

Vulnerability Publication Date: 1/14/2021

Reference Information

CVE: CVE-2021-21261

GLSA: 202101-21