CVE-2021-21261: 
NixOS vulnerability analysis and mitigation

CVE-2021-21261 is a high-severity vulnerability discovered in Flatpak, a Linux application sandboxing and distribution framework. The vulnerability was discovered by Simon McVittie and affects versions >= 0.11.4 and < 1.10.0, except for 1.8.x >= 1.8.5. The issue was disclosed on January 14, 2021, and fixed in versions 1.10.0 and 1.8.5 (GitHub Advisory).

The vulnerability exists in the flatpak-portal service (also known by its D-Bus service name org.freedesktop.portal.Flatpak) which allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance. The bug allows the portal service to pass caller-specified environment variables to non-sandboxed processes on the host system, particularly to the flatpak run command used to launch new sandbox instances (GitHub Advisory).

A malicious or compromised Flatpak app could exploit this vulnerability to set environment variables that are trusted by the flatpak run command, allowing the execution of arbitrary code outside the sandbox. This effectively enables a sandbox escape that could lead to code execution with the privileges of the host process (Gentoo Security).

The vulnerability can be exploited remotely by enticing a user to open a specially crafted Flatpak app. This could result in arbitrary code execution with the privileges of the process or a Denial of Service condition (Gentoo Security).

While the vulnerability can be mitigated by preventing the flatpak-portal service from starting, this workaround will prevent many Flatpak apps from working correctly. The recommended solution is to upgrade to Flatpak version 1.10.0 or later, or version 1.8.5 or later in the 1.8.x series. The fixes were implemented through multiple commits (6d1773d, 6e5ae7a, aeb6a7a, cc14010) (GitHub Advisory).