Bug 1934125 (CVE-2021-20271) - CVE-2021-20271 rpm: Signature checks bypass via corrupted rpm package
Summary: CVE-2021-20271 rpm: Signature checks bypass via corrupted rpm package
Keywords:
Status: NEW
Alias: CVE-2021-20271
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1935920 1935921 1938027 1958475 1958476 1958477
Blocks: 1912449 1935968 1938098 1938100
TreeView+ depends on / blocked
 
Reported: 2021-03-02 14:55 UTC by Pedro Sampaio
Modified: 2021-05-12 06:08 UTC (History)
15 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Pedro Sampaio 2021-03-02 14:55:30 UTC
A flaw was found in rpm. Given an RPM package signed by a trusted key, it is possible to modify it such that it still passes signature checks, but installing it corrupts the rpmdb.

Comment 5 Todd Cullum 2021-03-05 19:26:17 UTC
Flaw summary:

rpmReadPackageFile() is used to read RPM file headers. Internally, it calls headerMergeLegacySigs() which copies signature tags from the signature header to the main RPM metadata header (especially, legacy signatures). The logic in headerMergeLegacySigs() allows for copying of unknown tags from the signature header into the RPM header. It also does not check that correct tag type and size meet expectations. Thus, it's possible to supply an RPM file with a tag type error in the signature header, that gets copied into the RPM metadata header and subsequently placed into the RPM database as a corrupt header tag if the package is installed.

This causes the header to be inaccessible within the rpm database and could lead to data integrity issues such as corrupt header and bad tag errors when rpm reads the database, installed packages not actually being retrievable (shown as not installed), seemingly missing dependencies that are actually installed, etc...

This flaw does not cause data loss or permanent damage to the database, which can be repaired using the `rpmdb --rebuilddb` command, followed by installing the non-corrupted package.

Additionally, it requires running rpm against a malicious or malformed package which should never be in the official supported package repositories - so a Man-in-the-middle attack or attempting to install an unsupported or modified package would be required to trigger this.

Comment 7 Todd Cullum 2021-03-05 19:58:35 UTC
Acknowledgments:

Name: Demi M. Obenour

Comment 14 Todd Cullum 2021-03-11 23:10:00 UTC
Created rpm tracking bugs for this issue:

Affects: fedora-all [bug 1938027]

Comment 15 Todd Cullum 2021-03-17 15:46:25 UTC
Statement:

To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM.  It is strongly recommended to only use RPMs from trusted repositories.

Comment 17 Fedora Update System 2021-03-30 00:15:45 UTC
FEDORA-2021-2383d950fd has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 18 Fedora Update System 2021-03-30 01:10:19 UTC
FEDORA-2021-8d52a8a999 has been pushed to the Fedora 33 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 19 Fedora Update System 2021-04-07 15:25:44 UTC
FEDORA-2021-662680e477 has been pushed to the Fedora 32 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.