CVE-2021-41133: Other (NVD-CWE-Other)
value: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.8
Published: 2021-10-08T14:15Z
Repository: https://github.com/flatpak/flatpak
Language: Other
Files changed: common/Makefile.am.inc, common/flatpak-run.c, common/flatpak-syscalls-private.h
Commit date: 2021-10-08 12:53:20 +0200
Commit message: common: Add a list of recently-added Linux syscalls

Historically, syscalls could take arbitrarily-different values on
different architectures, but new syscalls are added with syscall numbers
that align on each architecture.

Signed-off-by: Simon McVittie <smcv@collabora.com>

Diff: diff --git a/common/Makefile.am.inc b/common/Makefile.am.inc
index d15da0891..892ee4ca7 100644
--- a/common/Makefile.am.inc
+++ b/common/Makefile.am.inc
@@ -158,10 +158,11 @@ libflatpak_common_la_SOURCES = \
 	common/flatpak-remote-ref-private.h \
 	common/flatpak-remote-ref.c \
 	common/flatpak-remote.c \
 	common/flatpak-run-private.h \
 	common/flatpak-run.c \
+	common/flatpak-syscalls-private.h \
 	common/flatpak-transaction-private.h \
 	common/flatpak-transaction.c \
 	common/flatpak-transaction.h \
 	common/flatpak-utils-http-private.h \
 	common/flatpak-utils-http.c \
diff --git a/common/flatpak-run.c b/common/flatpak-run.c
index ff6403d39..1c8273538 100644
--- a/common/flatpak-run.c
+++ b/common/flatpak-run.c
@@ -39,10 +39,12 @@
 #endif
 #ifdef HAVE_LIBMALCONTENT
 #include <libmalcontent/malcontent.h>
 #endif
 
+#include "flatpak-syscalls-private.h"
+
 #ifdef ENABLE_SECCOMP
 #include <seccomp.h>
 #endif
 
 #ifdef ENABLE_XAUTH
diff --git a/common/flatpak-syscalls-private.h b/common/flatpak-syscalls-private.h
new file mode 100644
index 000000000..04eb38ce3
--- /dev/null
+++ b/common/flatpak-syscalls-private.h
@@ -0,0 +1,197 @@
+/*
+ * Copyright 2021 Collabora Ltd.
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include <sys/syscall.h>
+
+#if defined(_MIPS_SIM)
+# if _MIPS_SIM == _MIPS_SIM_ABI32
+#   define FLATPAK_MISSING_SYSCALL_BASE 4000
+# elif _MIPS_SIM == _MIPS_SIM_ABI64
+#   define FLATPAK_MISSING_SYSCALL_BASE 5000
+# elif _MIPS_SIM == _MIPS_SIM_NABI32
+#   define FLATPAK_MISSING_SYSCALL_BASE 6000
+# else
+#   error "Unknown MIPS ABI"
+# endif
+#endif
+
+#if defined(__ia64__)
+# define FLATPAK_MISSING_SYSCALL_BASE 1024
+#endif
+
+#if defined(__alpha__)
+# define FLATPAK_MISSING_SYSCALL_BASE 110
+#endif
+
+#if defined(__x86_64__) && defined(__ILP32__)
+# define FLATPAK_MISSING_SYSCALL_BASE 0x40000000
+#endif
+
+/*
+ * FLATPAK_MISSING_SYSCALL_BASE:
+ *
+ * Number to add to the syscall numbers of recently-added syscalls
+ * to get the appropriate syscall for the current ABI.
+ */
+#ifndef FLATPAK_MISSING_SYSCALL_BASE
+# define FLATPAK_MISSING_SYSCALL_BASE 0
+#endif
+
+#ifndef __NR_open_tree
+# define __NR_open_tree (FLATPAK_MISSING_SYSCALL_BASE + 428)
+#endif
+#ifndef __SNR_open_tree
+# define __SNR_open_tree __NR_open_tree
+#endif
+
+#ifndef __NR_move_mount
+# define __NR_move_mount (FLATPAK_MISSING_SYSCALL_BASE + 429)
+#endif
+#ifndef __SNR_move_mount
+# define __SNR_move_mount __NR_move_mount
+#endif
+
+#ifndef __NR_fsopen
+# define __NR_fsopen (FLATPAK_MISSING_SYSCALL_BASE + 430)
+#endif
+#ifndef __SNR_fsopen
+# define __SNR_fsopen __NR_fsopen
+#endif
+
+#ifndef __NR_fsconfig
+# define __NR_fsconfig (FLATPAK_MISSING_SYSCALL_BASE + 431)
+#endif
+#ifndef __SNR_fsconfig
+# define __SNR_fsconfig __NR_fsconfig
+#endif
+
+#ifndef __NR_fsmount
+# define __NR_fsmount (FLATPAK_MISSING_SYSCALL_BASE + 432)
+#endif
+#ifndef __SNR_fsmount
+# define __SNR_fsmount __NR_fsmount
+#endif
+
+#ifndef __NR_fspick
+# define __NR_fspick (FLATPAK_MISSING_SYSCALL_BASE + 433)
+#endif
+#ifndef __SNR_fspick
+# define __SNR_fspick __NR_fspick
+#endif
+
+#ifndef __NR_pidfd_open
+# define __NR_pidfd_open (FLATPAK_MISSING_SYSCALL_BASE + 434)
+#endif
+#ifndef __SNR_pidfd_open
+# define __SNR_pidfd_open __NR_pidfd_open
+#endif
+
+#ifndef __NR_clone3
+# define __NR_clone3 (FLATPAK_MISSING_SYSCALL_BASE + 435)
+#endif
+#ifndef __SNR_clone3
+# define __SNR_clone3 __NR_clone3
+#endif
+
+#ifndef __NR_close_range
+# define __NR_close_range (FLATPAK_MISSING_SYSCALL_BASE + 436)
+#endif
+#ifndef __SNR_close_range
+# define __SNR_close_range __NR_close_range
+#endif
+
+#ifndef __NR_openat2
+# define __NR_openat2 (FLATPAK_MISSING_SYSCALL_BASE + 437)
+#endif
+#ifndef __SNR_openat2
+# define __SNR_openat2 __NR_openat2
+#endif
+
+#ifndef __NR_pidfd_getfd
+# define __NR_pidfd_getfd (FLATPAK_MISSING_SYSCALL_BASE + 438)
+#endif
+#ifndef __SNR_pidfd_getfd
+# define __SNR_pidfd_getfd __NR_pidfd_getfd
+#endif
+
+#ifndef __NR_faccessat2
+# define __NR_faccessat2 (FLATPAK_MISSING_SYSCALL_BASE + 439)
+#endif
+#ifndef __SNR_faccessat2
+# define __SNR_faccessat2 __NR_faccessat2
+#endif
+
+#ifndef __NR_process_madvise
+# define __NR_process_madvise (FLATPAK_MISSING_SYSCALL_BASE + 440)
+#endif
+#ifndef __SNR_process_madvise
+# define __SNR_process_madvise __NR_process_madvise
+#endif
+
+#ifndef __NR_epoll_pwait2
+# define __NR_epoll_pwait2 (FLATPAK_MISSING_SYSCALL_BASE + 441)
+#endif
+#ifndef __SNR_epoll_pwait2
+# define __SNR_epoll_pwait2 __NR_epoll_pwait2
+#endif
+
+#ifndef __NR_mount_setattr
+# define __NR_mount_setattr (FLATPAK_MISSING_SYSCALL_BASE + 442)
+#endif
+#ifndef __SNR_mount_setattr
+# define __SNR_mount_setattr __NR_mount_setattr
+#endif
+
+#ifndef __NR_quotactl_fd
+# define __NR_quotactl_fd (FLATPAK_MISSING_SYSCALL_BASE + 443)
+#endif
+#ifndef __SNR_quotactl_fd
+# define __SNR_quotactl_fd __NR_quotactl_fd
+#endif
+
+#ifndef __NR_landlock_create_ruleset
+# define __NR_landlock_create_ruleset (FLATPAK_MISSING_SYSCALL_BASE + 444)
+#endif
+#ifndef __SNR_landlock_create_ruleset
+# define __SNR_landlock_create_ruleset __NR_landlock_create_ruleset
+#endif
+
+#ifndef __NR_landlock_add_rule
+# define __NR_landlock_add_rule (FLATPAK_MISSING_SYSCALL_BASE + 445)
+#endif
+#ifndef __SNR_landlock_add_rule
+# define __SNR_landlock_add_rule __NR_landlock_add_rule
+#endif
+
+#ifndef __NR_landlock_restrict_self
+# define __NR_landlock_restrict_self (FLATPAK_MISSING_SYSCALL_BASE + 446)
+#endif
+#ifndef __SNR_landlock_restrict_self
+# define __SNR_landlock_restrict_self __NR_landlock_restrict_self
+#endif
+
+#ifndef __NR_memfd_secret
+# define __NR_memfd_secret (FLATPAK_MISSING_SYSCALL_BASE + 447)
+#endif
+#ifndef __SNR_memfd_secret
+# define __SNR_memfd_secret __NR_memfd_secret
+#endif
+
+/* Last updated: Linux 5.14, syscall numbers < 448 */

Fixed code: 	common/flatpak-syscalls-private.h \
#include "flatpak-syscalls-private.h"

/*
 * Copyright 2021 Collabora Ltd.
 * SPDX-License-Identifier: LGPL-2.1-or-later
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library. If not, see <http://www.gnu.org/licenses/>.
 */

#pragma once

#include <sys/syscall.h>

#if defined(_MIPS_SIM)
# if _MIPS_SIM == _MIPS_SIM_ABI32
#   define FLATPAK_MISSING_SYSCALL_BASE 4000
# elif _MIPS_SIM == _MIPS_SIM_ABI64
#   define FLATPAK_MISSING_SYSCALL_BASE 5000
# elif _MIPS_SIM == _MIPS_SIM_NABI32
#   define FLATPAK_MISSING_SYSCALL_BASE 6000
# else
#   error "Unknown MIPS ABI"
# endif
#endif

#if defined(__ia64__)
# define FLATPAK_MISSING_SYSCALL_BASE 1024
#endif

#if defined(__alpha__)
# define FLATPAK_MISSING_SYSCALL_BASE 110
#endif

#if defined(__x86_64__) && defined(__ILP32__)
# define FLATPAK_MISSING_SYSCALL_BASE 0x40000000
#endif

/*
 * FLATPAK_MISSING_SYSCALL_BASE:
 *
 * Number to add to the syscall numbers of recently-added syscalls
 * to get the appropriate syscall for the current ABI.
 */
#ifndef FLATPAK_MISSING_SYSCALL_BASE
# define FLATPAK_MISSING_SYSCALL_BASE 0
#endif

#ifndef __NR_open_tree
# define __NR_open_tree (FLATPAK_MISSING_SYSCALL_BASE + 428)
#endif
#ifndef __SNR_open_tree
# define __SNR_open_tree __NR_open_tree
#endif

#ifndef __NR_move_mount
# define __NR_move_mount (FLATPAK_MISSING_SYSCALL_BASE + 429)
#endif
#ifndef __SNR_move_mount
# define __SNR_move_mount __NR_move_mount
#endif

#ifndef __NR_fsopen
# define __NR_fsopen (FLATPAK_MISSING_SYSCALL_BASE + 430)
#endif
#ifndef __SNR_fsopen
# define __SNR_fsopen __NR_fsopen
#endif

#ifndef __NR_fsconfig
# define __NR_fsconfig (FLATPAK_MISSING_SYSCALL_BASE + 431)
#endif
#ifndef __SNR_fsconfig
# define __SNR_fsconfig __NR_fsconfig
#endif

#ifndef __NR_fsmount
# define __NR_fsmount (FLATPAK_MISSING_SYSCALL_BASE + 432)
#endif
#ifndef __SNR_fsmount
# define __SNR_fsmount __NR_fsmount
#endif

#ifndef __NR_fspick
# define __NR_fspick (FLATPAK_MISSING_SYSCALL_BASE + 433)
#endif
#ifndef __SNR_fspick
# define __SNR_fspick __NR_fspick
#endif

#ifndef __NR_pidfd_open
# define __NR_pidfd_open (FLATPAK_MISSING_SYSCALL_BASE + 434)
#endif
#ifndef __SNR_pidfd_open
# define __SNR_pidfd_open __NR_pidfd_open
#endif

#ifndef __NR_clone3
# define __NR_clone3 (FLATPAK_MISSING_SYSCALL_BASE + 435)
#endif
#ifndef __SNR_clone3
# define __SNR_clone3 __NR_clone3
#endif

#ifndef __NR_close_range
# define __NR_close_range (FLATPAK_MISSING_SYSCALL_BASE + 436)
#endif
#ifndef __SNR_close_range
# define __SNR_close_range __NR_close_range
#endif

#ifndef __NR_openat2
# define __NR_openat2 (FLATPAK_MISSING_SYSCALL_BASE + 437)
#endif
#ifndef __SNR_openat2
# define __SNR_openat2 __NR_openat2
#endif

#ifndef __NR_pidfd_getfd
# define __NR_pidfd_getfd (FLATPAK_MISSING_SYSCALL_BASE + 438)
#endif
#ifndef __SNR_pidfd_getfd
# define __SNR_pidfd_getfd __NR_pidfd_getfd
#endif

#ifndef __NR_faccessat2
# define __NR_faccessat2 (FLATPAK_MISSING_SYSCALL_BASE + 439)
#endif
#ifndef __SNR_faccessat2
# define __SNR_faccessat2 __NR_faccessat2
#endif

#ifndef __NR_process_madvise
# define __NR_process_madvise (FLATPAK_MISSING_SYSCALL_BASE + 440)
#endif
#ifndef __SNR_process_madvise
# define __SNR_process_madvise __NR_process_madvise
#endif

#ifndef __NR_epoll_pwait2
# define __NR_epoll_pwait2 (FLATPAK_MISSING_SYSCALL_BASE + 441)
#endif
#ifndef __SNR_epoll_pwait2
# define __SNR_epoll_pwait2 __NR_epoll_pwait2
#endif

#ifndef __NR_mount_setattr
# define __NR_mount_setattr (FLATPAK_MISSING_SYSCALL_BASE + 442)
#endif
#ifndef __SNR_mount_setattr
# define __SNR_mount_setattr __NR_mount_setattr
#endif

#ifndef __NR_quotactl_fd
# define __NR_quotactl_fd (FLATPAK_MISSING_SYSCALL_BASE + 443)
#endif
#ifndef __SNR_quotactl_fd
# define __SNR_quotactl_fd __NR_quotactl_fd
#endif

#ifndef __NR_landlock_create_ruleset
# define __NR_landlock_create_ruleset (FLATPAK_MISSING_SYSCALL_BASE + 444)
#endif
#ifndef __SNR_landlock_create_ruleset
# define __SNR_landlock_create_ruleset __NR_landlock_create_ruleset
#endif

#ifndef __NR_landlock_add_rule
# define __NR_landlock_add_rule (FLATPAK_MISSING_SYSCALL_BASE + 445)
#endif
#ifndef __SNR_landlock_add_rule
# define __SNR_landlock_add_rule __NR_landlock_add_rule
#endif

#ifndef __NR_landlock_restrict_self
# define __NR_landlock_restrict_self (FLATPAK_MISSING_SYSCALL_BASE + 446)
#endif
#ifndef __SNR_landlock_restrict_self
# define __SNR_landlock_restrict_self __NR_landlock_restrict_self
#endif

#ifndef __NR_memfd_secret
# define __NR_memfd_secret (FLATPAK_MISSING_SYSCALL_BASE + 447)
#endif
#ifndef __SNR_memfd_secret
# define __SNR_memfd_secret __NR_memfd_secret
#endif

/* Last updated: Linux 5.14, syscall numbers < 448 */