CVE-2021-43860
📋 TL;DR
This vulnerability in Flatpak allows malicious applications to grant themselves hidden permissions without user consent by exploiting a null byte in metadata files. Users who install Flatpak applications from untrusted sources are at risk, as attackers can craft metadata to hide additional permissions after a null terminator.
💻 Affected Systems
- Flatpak
📦 What is this software?
Fedora by Fedoraproject
Flatpak by Flatpak
Flatpak by Flatpak
⚠️ Risk & Real-World Impact
Worst Case
Malicious Flatpak applications gain unauthorized system access, potentially leading to data theft, privilege escalation, or complete system compromise.
Likely Case
Malicious applications gain additional permissions beyond what users approved, enabling unauthorized access to system resources or user data.
If Mitigated
With proper controls and trusted sources, risk is limited to applications that users intentionally install from verified repositories.
🎯 Exploit Status
Exploitation requires users to install malicious Flatpak applications from untrusted sources.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.12.3 or 1.10.6
Vendor Advisory: https://github.com/flatpak/flatpak/security/advisories/GHSA-4ppf-fxf6-vxg2
Restart Required: No
Instructions:
1. Update Flatpak using your distribution's package manager. 2. For Ubuntu/Debian: sudo apt update && sudo apt upgrade flatpak. 3. For Fedora/RHEL: sudo dnf update flatpak. 4. For Arch: sudo pacman -Syu flatpak.
🔧 Temporary Workarounds
Manual permission verification
linuxManually check permissions of installed Flatpak applications by examining metadata files
flatpak info --show-permissions <app-id>
flatpak info --show-metadata <app-id> | grep -a xa.metadata
🧯 If You Can't Patch
- Only install Flatpak applications from trusted, official repositories
- Audit existing Flatpak installations for suspicious permissions or metadata
🔍 How to Verify
Check if Vulnerable:
Check Flatpak version: flatpak --version. If version is below 1.12.3 (for 1.12.x) or below 1.10.6 (for 1.10.x), system is vulnerable.Check Version:
flatpak --versionVerify Fix Applied:
Verify Flatpak version is 1.12.3 or higher, or 1.10.6 or higher: flatpak --version📡 Detection & Monitoring
Log Indicators:
- Unusual permission grants during Flatpak installation
- Suspicious metadata modifications in Flatpak applications
Network Indicators:
- Downloads from untrusted Flatpak repositories
SIEM Query:
Process execution of flatpak install from non-standard sources or with unusual parameters🔗 References
- https://github.com/flatpak/flatpak/commit/54ec1a482dfc668127eaae57f135e6a8e0bc52da
- https://github.com/flatpak/flatpak/commit/65cbfac982cb1c83993a9e19aa424daee8e9f042
- https://github.com/flatpak/flatpak/commit/93357d357119093804df05acc32ff335839c6451
- https://github.com/flatpak/flatpak/commit/ba818f504c926baaf6e362be8159cfacf994310e
- https://github.com/flatpak/flatpak/commit/d9a8f9d8ccc0b7c1135d0ecde006a75d25f66aee
- https://github.com/flatpak/flatpak/releases/tag/1.10.6
- https://github.com/flatpak/flatpak/releases/tag/1.12.3
- https://github.com/flatpak/flatpak/security/advisories/GHSA-qpjc-vq3c-572j
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APFTBYGJJVJPFVHRXUW5PII5XOAFI4KH/
- https://security.gentoo.org/glsa/202312-12
- https://www.debian.org/security/2022/dsa-5049
- https://github.com/flatpak/flatpak/commit/54ec1a482dfc668127eaae57f135e6a8e0bc52da
- https://github.com/flatpak/flatpak/commit/65cbfac982cb1c83993a9e19aa424daee8e9f042
- https://github.com/flatpak/flatpak/commit/93357d357119093804df05acc32ff335839c6451
- https://github.com/flatpak/flatpak/commit/ba818f504c926baaf6e362be8159cfacf994310e
- https://github.com/flatpak/flatpak/commit/d9a8f9d8ccc0b7c1135d0ecde006a75d25f66aee
- https://github.com/flatpak/flatpak/releases/tag/1.10.6
- https://github.com/flatpak/flatpak/releases/tag/1.12.3
- https://github.com/flatpak/flatpak/security/advisories/GHSA-qpjc-vq3c-572j
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APFTBYGJJVJPFVHRXUW5PII5XOAFI4KH/
- https://security.gentoo.org/glsa/202312-12
- https://www.debian.org/security/2022/dsa-5049
