CVE-2022-21682 (XML, published 2022-01-13T21:15Z)
Description: value: Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/flatpak/flatpak
Files changed:
doc/flatpak-build-finish.xml
doc/flatpak-build.xml
doc/flatpak-override.xml
doc/flatpak-run.xml
Commit message: manpages: Document the new details of --nofilesystem behaviour.


Vulnerable code:

Fixed code:
                </para><para>
                    In general, "--nofilesystem=PATH" will remove access to a specific path if exactly that path
                    was previously granted. However, as a special case, "--nofilesystem=home"  will remove access to all
                    previously granted locations inside the homedir as well, such as "home/some-dir", or "xdg-download",
                    and "--nofilesystem=host" will remove access to all previously granted locations.
                    Note: absolute paths that happen to be inside the current users home directory are not considered for
                    this special case.
                </para><para>
                    In general, "--nofilesystem=PATH" will remove access to a specific path if exactly that path
                    was previously granted. However, as a special case, "--nofilesystem=home" will remove access to all
                    previously granted locations inside the homedir as well, such as "home/some-dir", or "xdg-download",
                    and "--nofilesystem=host" will remove access to all previously granted locations.
                    Note: absolute paths that happen to be inside the current users home directory are not considered for
                    this special case.
                </para><para>
                    In general, "--nofilesystem=PATH" will remove access to a specific path if exactly that path
                    was previously granted. However, as a special case, "--nofilesystem=home" will remove access to all
                    previously granted locations inside the homedir as well, such as "home/some-dir", or "xdg-download",
                    and "--nofilesystem=host" will remove access to all previously granted locations.
                    Note: absolute paths that happen to be inside the current users home directory are not considered for
                    this special case.
                </para><para>
                    In general, "--nofilesystem=PATH" will remove access to a specific path if exactly that path
                    was previously granted. However, as a special case, "--nofilesystem=home" will remove access to all
                    previously granted locations inside the homedir as well, such as "home/some-dir", or "xdg-download",
                    and "--nofilesystem=host" will remove access to all previously granted locations.
                    Note: absolute paths that happen to be inside the current users home directory are not considered for
                    this special case.