CVE-2021-21381: 
NixOS vulnerability analysis and mitigation

CVE-2021-21381 affects Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. The vulnerability was discovered in versions since 0.9.4 and before version 1.10.2, affecting the "file forwarding" feature. The issue was disclosed and patched in March 2021 (GitHub Advisory).

The vulnerability exists in Flatpak's handling of special tokens in .desktop files. By manipulating the Exec field of a Flatpak app's .desktop file with special tokens '@@' and/or '@@u', an attacker could exploit the file forwarding feature. The vulnerability has been assigned a CVSS v3.1 base score of 8.2 (HIGH) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (NVD).

The vulnerability allows a malicious app publisher to trick Flatpak into behaving as though the user had chosen to open a target file with their Flatpak app. This automatically makes that file available to the Flatpak app, effectively bypassing the app's normal permission restrictions and gaining access to files that would not ordinarily be allowed (GitHub Advisory).

The vulnerability requires local access and user interaction. An attacker would need to create a malicious Flatpak application with specially crafted .desktop files and convince a user to install it. The vulnerability has been classified as having low attack complexity (NVD).

The vulnerability was fixed in Flatpak version 1.10.2. Users are advised to upgrade to this version or later. As a workaround, users can avoid installing Flatpak apps from untrusted sources or check the contents of exported .desktop files in exports/share/applications/.desktop (typically ~/.local/share/flatpak/exports/share/applications/.desktop and /var/lib/flatpak/exports/share/applications/*.desktop) to ensure that literal filenames do not follow @@ or @@u (GitHub Advisory).

The vulnerability was treated as a significant security issue, with multiple Linux distributions releasing security advisories and patches, including Debian, Red Hat, Fedora, and Gentoo. The fix was implemented through a series of commits that not only addressed the immediate vulnerability but also added preventive measures for similar future issues (Debian Advisory, Gentoo Advisory).