A flaw was found in rpm. Given an RPM package signed by a trusted key, it is possible to modify it such that it still passes signature checks, but installing it corrupts the rpmdb.
Flaw summary: rpmReadPackageFile() is used to read RPM file headers. Internally, it calls headerMergeLegacySigs() which copies signature tags from the signature header to the main RPM metadata header (especially, legacy signatures). The logic in headerMergeLegacySigs() allows for copying of unknown tags from the signature header into the RPM header. It also does not check that correct tag type and size meet expectations. Thus, it's possible to supply an RPM file with a tag type error in the signature header, that gets copied into the RPM metadata header and subsequently placed into the RPM database as a corrupt header tag if the package is installed. This causes the header to be inaccessible within the rpm database and could lead to data integrity issues such as corrupt header and bad tag errors when rpm reads the database, installed packages not actually being retrievable (shown as not installed), seemingly missing dependencies that are actually installed, etc... This flaw does not cause data loss or permanent damage to the database, which can be repaired using the `rpmdb --rebuilddb` command, followed by installing the non-corrupted package. Additionally, it requires running rpm against a malicious or malformed package which should never be in the official supported package repositories - so a Man-in-the-middle attack or attempting to install an unsupported or modified package would be required to trigger this.
Acknowledgments: Name: Demi M. Obenour
Created rpm tracking bugs for this issue: Affects: fedora-all [bug 1938027]
Statement: To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM. It is strongly recommended to only use RPMs from trusted repositories.
Upstream patch: https://github.com/rpm-software-management/rpm/commit/d6a86b5e69e46cc283b1e06c92343319beb42e21
FEDORA-2021-2383d950fd has been pushed to the Fedora 34 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2021-8d52a8a999 has been pushed to the Fedora 33 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2021-662680e477 has been pushed to the Fedora 32 stable repository. If problem still persists, please make note of it in this bug report.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:2574 https://access.redhat.com/errata/RHSA-2021:2574
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-20271
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2021:2791 https://access.redhat.com/errata/RHSA-2021:2791
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.6 Advanced Update Support Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions Red Hat Enterprise Linux 7.6 Telco Extended Update Support Via RHSA-2021:4771 https://access.redhat.com/errata/RHSA-2021:4771
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2021:4785 https://access.redhat.com/errata/RHSA-2021:4785
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Advanced Update Support Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions Red Hat Enterprise Linux 7.7 Telco Extended Update Support Via RHSA-2021:4975 https://access.redhat.com/errata/RHSA-2021:4975