Bug 1934125 (CVE-2021-20271)
| Summary: | CVE-2021-20271 rpm: Signature checks bypass via corrupted rpm package | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | dchong, ffesti, igor.raits, jberan, kaycoth, mdomonko, mjw, packaging-team-maint, pasteur, pmatilai, pmoravco, security-response-team, sgrubb, tcullum, timo.henriksson, vmugicag, vmukhame |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-06-29 22:40:23 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1935920, 1935921, 1938027, 1958475, 1958476, 1958477, 2004226, 2004227, 2004228 | ||
| Bug Blocks: | 1912449, 1935968, 1938098, 1938100 | ||
|
Description
Pedro Sampaio
2021-03-02 14:55:30 UTC
Flaw summary: rpmReadPackageFile() is used to read RPM file headers. Internally, it calls headerMergeLegacySigs() which copies signature tags from the signature header to the main RPM metadata header (especially, legacy signatures). The logic in headerMergeLegacySigs() allows for copying of unknown tags from the signature header into the RPM header. It also does not check that correct tag type and size meet expectations. Thus, it's possible to supply an RPM file with a tag type error in the signature header, that gets copied into the RPM metadata header and subsequently placed into the RPM database as a corrupt header tag if the package is installed. This causes the header to be inaccessible within the rpm database and could lead to data integrity issues such as corrupt header and bad tag errors when rpm reads the database, installed packages not actually being retrievable (shown as not installed), seemingly missing dependencies that are actually installed, etc... This flaw does not cause data loss or permanent damage to the database, which can be repaired using the `rpmdb --rebuilddb` command, followed by installing the non-corrupted package. Additionally, it requires running rpm against a malicious or malformed package which should never be in the official supported package repositories - so a Man-in-the-middle attack or attempting to install an unsupported or modified package would be required to trigger this. Acknowledgments: Name: Demi M. Obenour Created rpm tracking bugs for this issue: Affects: fedora-all [bug 1938027] Statement: To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM. It is strongly recommended to only use RPMs from trusted repositories. Upstream patch: https://github.com/rpm-software-management/rpm/commit/d6a86b5e69e46cc283b1e06c92343319beb42e21 FEDORA-2021-2383d950fd has been pushed to the Fedora 34 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2021-8d52a8a999 has been pushed to the Fedora 33 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2021-662680e477 has been pushed to the Fedora 32 stable repository. If problem still persists, please make note of it in this bug report. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:2574 https://access.redhat.com/errata/RHSA-2021:2574 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-20271 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2021:2791 https://access.redhat.com/errata/RHSA-2021:2791 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.6 Advanced Update Support Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions Red Hat Enterprise Linux 7.6 Telco Extended Update Support Via RHSA-2021:4771 https://access.redhat.com/errata/RHSA-2021:4771 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2021:4785 https://access.redhat.com/errata/RHSA-2021:4785 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Advanced Update Support Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions Red Hat Enterprise Linux 7.7 Telco Extended Update Support Via RHSA-2021:4975 https://access.redhat.com/errata/RHSA-2021:4975 |