Update for CVE-2021-41133

[Andrew Hayzen]

[Links]
https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=995935
https://security-tracker.debian.org/tracker/CVE-2021-41133

[Impact]
Versions in Ubuntu right now:
Impish: 1.10.2-3
Hirsute: 1.10.2-1ubuntu1
Focal: 1.6.5-0ubuntu0.3
Bionic: 1.0.9-0ubuntu0.3

Affected versions:
    1.11.x, 1.10.x <= 1.10.3, all <= 1.8.2

Patched versions:
    1.10.5, 1.12.1, also expected in 1.8.2

[Test Case]
Unknown

[Regression Potential]
Flatpak has a test suite, which is run on build across all relevant architectures and passes.

There is also a manual test plan https://wiki.ubuntu.com/Process/Merges/TestPlan/flatpak .

Flatpak has autopkgtests enabled http://autopkgtest.ubuntu.com/packages/f/flatpak .

Regression potential is low, and upstream is very responsive to any issues raised.

[Patches]
There were 8 initial patches, then some regressions have been found, one has been patched, but a second has a pending pull request (see the github advisory for links). As noted in the debian bug as well there might be further changes to bubblewrap, so guess it makes sense to wait until this has settled.

[Other Information]
An anonymous reporter discovered that Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process, by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted /.flatpak-info or make that file disappear entirely.
Impact

Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has.

Mitigation: Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process xdg-dbus-proxy, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses.

[Andrew Hayzen (ahayzen)]

If someone has the permissions could they add bionic, focal, hirsute, and impish as affected series ?

[Simon McVittie (smcv)]

I think we have the regressions under control now.

https://salsa.debian.org/debian/flatpak/-/commits/wip/1.10.x/ is packaging of 1.10.5 aimed at inclusion in Debian 11, including one post-1.10.5 bug fix https://github.com/flatpak/flatpak/pull/4461 which will hopefully be included in 1.10.6. I'm waiting for an opinion from the Debian security team. For release series that are already based on 1.10.x, I'd recommend basing your releases on that version.

For full effectiveness, you'll want libseccomp 2.5.2, with which we can block all the syscalls we identified as undesired, including `mount_setattr()`.

Failing that, libseccomp 2.5.0 is sufficient to be able to block `clone3()`, which I think should prevent a successful exploit: by preventing creation of new user namespaces, it stops a malicious or compromised Flatpak app from getting CAP_SYS_ADMIN in a new user namespace, which it would need if it wanted to be able to invoke `mount_setattr()`.

For release series that use 1.6.x or 1.0.x, Flatpak upstream does not support those branches any more and will not make new releases. If someone wants to get involved upstream, I'd accept MRs against those branches as a coordination point for "if you're stuck on this branch, here's what other distros are doing...", similar to what I'm doing for 1.2.x on https://github.com/flatpak/flatpak/pull/4455.

[Andrew Hayzen (ahayzen)]

Please find attached the debdiff for Ubuntu 21.10 impish. I have performed some testing in a VM and built in a PPA.

Let me know if anything has been done incorrectly.

[Andrew Hayzen (ahayzen)]

Please find attached the debdiff for Ubuntu 21.04 hirsute. I have performed some testing in a VM and built in a PPA.

Let me know if anything has been done incorrectly.

[Andrew Hayzen (ahayzen)]

So hirsute and impish have libseccomp 2.5.1, but focal and bionic have 2.4.3 in the security pocket and 2.5.1 in the updates pocket. I'm not sure if there is procedure here to try and pull 2.5.1 of focal and bionic into the security pocket with flatpak - if that is needed to solve the security issue.

Focal and bionic will need also rebasing of the patches, I might take a look at this over the weekend if no one else does.

[Andrew Hayzen (ahayzen)]

I've got a set of rebased changes for focal prepared, but I'm waiting for the PPA to build and test (currently stuck in a queue as 22.04 is opening). So I'll assign focal to myself and hopefully will be able to test this tomorrow when the build completes.

[Andrew Hayzen (ahayzen)]

Please find attached the debdiff for Ubuntu 20.04 focal. I have performed some testing in a VM and built in a PPA.

Note that for focal, we likely want to use the version of libseccomp2 from focal-updates (2.5.1-1ubuntu1~20.04.1) rather than focal-security (2.4.3-1ubuntu3.20.04.3). Is is possible to move libseccomp2 2.5.1-1ubuntu1~20.04.1 to focal-security? (and depending what happens here, then means a change to the control file to specify the version?)

Let me know if anything has been done incorrectly.

[Andrew Hayzen (ahayzen)]

Please find attached the debdiff for Ubuntu 18.04 bionic. I have performed some testing in a VM and built in a PPA.

Note that for bionic (same as focal), we likely want to use the version of libseccomp2 from bionic-updates ( 2.5.1-1ubuntu1~18.04.1) rather than focal-security ( 2.4.3-1ubuntu3.18.04.3). Is is possible to move libseccomp2 2.5.1-1ubuntu1~18.04.1 to focal-security? (and depending what happens here, then means a change to the control file of flatpak to specify the version?)

Let me know if anything has been done incorrectly.

[Marc Deslauriers (mdeslaur)]

@alex Do you think we can do a no-change rebuild of libseccomp into bionic-security and focal-security? Are there any dependencies we need to rebuild too?

[Alex Murray (alexmurray)]

@mdeslaur - sure I think a no-change rebuild would be fine for libseccomp, there are no other dependencies that I am aware of for it (it requires valgrind at build-time to run some unit tests and these fail on arm64 IIRC for the valgrind version in bionic-security/release but succeed with the version in bionic-updates - hence I have a copy of this in the security-proposed PPA from the last time I was doing libseccomp builds there - https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages)

So assuming we use the security-proposed PPA to do the no-change rebuild it should just work.

[Marc Deslauriers (mdeslaur)]

ACK on the debdiffs, I've uploaded them with a slight changelog formatting change, and I've specified a specific version for the libseccomp Build-Depends on bionic and focal.

I've build the packages, along with the required libseccomp updates in the following PPA:

https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages

Could you please test them and comment here if they appear to work ok? Thanks!

[Brian Murray (brian-murray)]

Given that the security team is working on this I'm unsubscribing ubuntu-sponsors.

[Andrew Hayzen (ahayzen)]

Sorry, I somehow missed comment 11 and was thinking we were still waiting for the libseccomp decision. I'll check the packages now!

[Andrew Hayzen (ahayzen)]

I've done some exploratory testing of Wayland/portal related tests from the test plan on a Focal VM and things are working normally.

$ apt policy flatpak
flatpak:
  Installed: 1.6.5-0ubuntu0.4
  Candidate: 1.6.5-0ubuntu0.4
  Version table:
 *** 1.6.5-0ubuntu0.4 500
        500 http://ppa.launchpad.net/ubuntu-security-proposed/ppa/ubuntu focal/main amd64 Packages
        100 /var/lib/dpkg/status
     1.6.5-0ubuntu0.3 500
        500 http://gb.archive.ubuntu.com/ubuntu focal-updates/universe amd64 Packages
        500 http://security.ubuntu.com/ubuntu focal-security/universe amd64 Packages
     1.6.3-1 500
        500 http://gb.archive.ubuntu.com/ubuntu focal/universe amd64 Packages

[Andrew Hayzen (ahayzen)]

I've done some exploratory testing of Wayland/portal related tests from the test plan on a Bionic VM and things are working normally.

$ apt policy flatpak
flatpak:
  Installed: 1.0.9-0ubuntu0.4
  Candidate: 1.0.9-0ubuntu0.4
  Version table:
 *** 1.0.9-0ubuntu0.4 500
        500 http://ppa.launchpad.net/ubuntu-security-proposed/ppa/ubuntu bionic/main amd64 Packages
        100 /var/lib/dpkg/status
     1.0.9-0ubuntu0.3 500
        500 http://gb.archive.ubuntu.com/ubuntu bionic-updates/universe amd64 Packages
        500 http://security.ubuntu.com/ubuntu bionic-security/universe amd64 Packages
     0.11.3-3 500
        500 http://gb.archive.ubuntu.com/ubuntu bionic/universe amd64 Packages

[Andrew Hayzen (ahayzen)]

I've done some exploratory testing of Wayland/portal related tests from the test plan on a Hirsute VM and things are working normally.

$ apt policy flatpak
flatpak:
  Installed: 1.10.2-1ubuntu1.1
  Candidate: 1.10.2-1ubuntu1.1
  Version table:
 *** 1.10.2-1ubuntu1.1 500
        500 http://ppa.launchpad.net/ubuntu-security-proposed/ppa/ubuntu hirsute/main amd64 Packages
        100 /var/lib/dpkg/status
     1.10.2-1ubuntu1 500
        500 http://gb.archive.ubuntu.com/ubuntu hirsute/universe amd64 Packages

[Andrew Hayzen (ahayzen)]

I've done some exploratory testing of Wayland/portal related tests from the test plan on a Impish VM and things are working normally.

$ apt policy flatpak
flatpak:
  Installed: 1.10.2-3ubuntu0.1
  Candidate: 1.10.2-3ubuntu0.1
  Version table:
 *** 1.10.2-3ubuntu0.1 500
        500 http://ppa.launchpad.net/ubuntu-security-proposed/ppa/ubuntu impish/main amd64 Packages
        100 /var/lib/dpkg/status
     1.10.2-3 500
        500 http://gb.archive.ubuntu.com/ubuntu impish/universe amd64 Packages

[Launchpad Janitor (janitor)]

This bug was fixed in the package flatpak - 1.10.2-3ubuntu0.1

---------------
flatpak (1.10.2-3ubuntu0.1) impish-security; urgency=medium

  * SECURITY UPDATE: Sandbox bypass via recent VFS-manipulating syscalls
    (LP: #1946578)
    - debian/paches/CVE-2021-41133-1.patch
    - debian/paches/CVE-2021-41133-2.patch
    - debian/paches/CVE-2021-41133-3.patch
    - debian/paches/CVE-2021-41133-4.patch
    - debian/paches/CVE-2021-41133-5.patch
    - debian/paches/CVE-2021-41133-6.patch
    - debian/paches/CVE-2021-41133-7.patch
    - debian/paches/CVE-2021-41133-8.patch
    - debian/paches/CVE-2021-41133-9.patch
    - debian/paches/CVE-2021-41133-10.patch
    - CVE-2021-41133

 -- Andrew Hayzen <email address hidden> Wed, 13 Oct 2021 00:36:35 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package flatpak - 1.10.2-1ubuntu1.1

---------------
flatpak (1.10.2-1ubuntu1.1) hirsute-security; urgency=medium

  * SECURITY UPDATE: Sandbox bypass via recent VFS-manipulating syscalls
    (LP: #1946578)
    - debian/paches/CVE-2021-41133-1.patch
    - debian/paches/CVE-2021-41133-2.patch
    - debian/paches/CVE-2021-41133-3.patch
    - debian/paches/CVE-2021-41133-4.patch
    - debian/paches/CVE-2021-41133-5.patch
    - debian/paches/CVE-2021-41133-6.patch
    - debian/paches/CVE-2021-41133-7.patch
    - debian/paches/CVE-2021-41133-8.patch
    - debian/paches/CVE-2021-41133-9.patch
    - debian/paches/CVE-2021-41133-10.patch
    - CVE-2021-41133

 -- Andrew Hayzen <email address hidden> Wed, 13 Oct 2021 00:36:35 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package flatpak - 1.6.5-0ubuntu0.4

---------------
flatpak (1.6.5-0ubuntu0.4) focal-security; urgency=medium

  * SECURITY UPDATE: Sandbox bypass via recent VFS-manipulating syscalls
    (LP: #1946578)
    - debian/paches/CVE-2021-41133-1.patch
    - debian/paches/CVE-2021-41133-2.patch
    - debian/paches/CVE-2021-41133-3.patch
    - debian/paches/CVE-2021-41133-4.patch
    - debian/paches/CVE-2021-41133-5.patch
    - debian/paches/CVE-2021-41133-6.patch
    - debian/paches/CVE-2021-41133-7.patch
    - debian/paches/CVE-2021-41133-8.patch
    - debian/paches/CVE-2021-41133-9.patch
    - debian/paches/CVE-2021-41133-10.patch
    - CVE-2021-41133

 -- Andrew Hayzen <email address hidden> Wed, 13 Oct 2021 00:36:35 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package flatpak - 1.0.9-0ubuntu0.4

---------------
flatpak (1.0.9-0ubuntu0.4) bionic-security; urgency=medium

  * SECURITY UPDATE: Sandbox bypass via recent VFS-manipulating syscalls
    (LP: #1946578)
    - debian/paches/CVE-2021-41133-1.patch
    - debian/paches/CVE-2021-41133-2.patch
    - debian/paches/CVE-2021-41133-3.patch
    - debian/paches/CVE-2021-41133-4.patch
    - debian/paches/CVE-2021-41133-5.patch
    - debian/paches/CVE-2021-41133-6.patch
    - debian/paches/CVE-2021-41133-7.patch
    - debian/paches/CVE-2021-41133-8.patch
    - debian/paches/CVE-2021-41133-9.patch
    - debian/paches/CVE-2021-41133-10.patch
    - CVE-2021-41133

 -- Andrew Hayzen <email address hidden> Wed, 13 Oct 2021 00:36:35 +0100

[Marc Deslauriers (mdeslaur)]

Thanks for testing!

https://ubuntu.com/security/notices/USN-5191-1