Bug 2004957 (CVE-2021-41072)

Summary: CVE-2021-41072 squashfs-tools: possible Directory Traversal via symbolic link
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: adas, bruno, katzj, kyle, mvanderw, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A directory traversal flaw was found in squashfs-tools. During extraction, a file can escape the destination directory by using a symbolic link, and a regular file with an identical name. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2007304, 2004958, 2007302, 2007303    
Bug Blocks: 2004960    

Description Marian Rehak 2021-09-16 13:48:12 UTC
A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.

Upstream Issue:

https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405

Comment 1 Marian Rehak 2021-09-16 13:48:38 UTC
Created squashfs-tools tracking bugs for this issue:

Affects: fedora-all [bug 2004958]

Comment 6 Bruno Wolff III 2021-09-27 19:40:36 UTC
It is fixed in f35 and rawhide. I need to wait one more day before I can move from testing to stable in f33 and f34. The previous security fix didn't get into f33, because I didn't wait for the previous update to get to stable there before creating the new update and the older update got obsoleted.

Comment 8 Bruno Wolff III 2021-10-06 06:21:04 UTC
The fixed version is now in all current versions of Fedora.