Bug 2004957 (CVE-2021-41072)

Summary:	CVE-2021-41072 squashfs-tools: possible Directory Traversal via symbolic link
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adas, bruno, katzj, kyle, mvanderw, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A directory traversal flaw was found in squashfs-tools. During extraction, a file can escape the destination directory by using a symbolic link, and a regular file with an identical name. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2004958, 2007302, 2007303, 2007304
Bug Blocks:	2004960

Description Marian Rehak 2021-09-16 13:48:12 UTC

A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.

Upstream Issue:

https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405

Comment 1 Marian Rehak 2021-09-16 13:48:38 UTC

Created squashfs-tools tracking bugs for this issue:

Affects: fedora-all [bug 2004958]

Comment 4 Cedric Buissart 2021-09-23 15:28:58 UTC

Upstream fix :
https://github.com/plougher/squashfs-tools/commit/e0485802ec72996c20026da320650d8362f555bd

Comment 6 Bruno Wolff III 2021-09-27 19:40:36 UTC

It is fixed in f35 and rawhide. I need to wait one more day before I can move from testing to stable in f33 and f34. The previous security fix didn't get into f33, because I didn't wait for the previous update to get to stable there before creating the new update and the older update got obsoleted.

Comment 8 Bruno Wolff III 2021-10-06 06:21:04 UTC

The fixed version is now in all current versions of Fedora.

Comment 10 errata-xmlrpc 2024-04-30 10:07:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2396 https://access.redhat.com/errata/RHSA-2024:2396

Comment 11 errata-xmlrpc 2024-05-22 09:49:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:3139 https://access.redhat.com/errata/RHSA-2024:3139