Ubuntu 21.10 Security Advisory: USN-5191-1 Critical Flatpak Escape

ubuntu

December 14, 2021

A system hardening measure could be bypassed.

Summary

A system hardening measure could be bypassed.

Software Description:

- flatpak: Application deployment framework for desktop apps

Details:

It was discovered that Flatpak incorrectly handled certain AF_UNIX sockets.

An attacker could use this to specially craft a Flatpak application that

could escape sandbox confinement.

Topics Covered

security advisory critical ubuntu sandbox escape flatpak

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  flatpak                         1.10.2-3ubuntu0.1
  libflatpak0                     1.10.2-3ubuntu0.1

Ubuntu 21.04:
  flatpak                         1.10.2-1ubuntu1.1
  libflatpak0                     1.10.2-1ubuntu1.1

Ubuntu 20.04 LTS:
  flatpak                         1.6.5-0ubuntu0.4
  libflatpak0                     1.6.5-0ubuntu0.4

Ubuntu 18.04 LTS:
  flatpak                         1.0.9-0ubuntu0.4
  libflatpak0                     1.0.9-0ubuntu0.4

In general, a standard system update will make all the necessary changes.