Bug 2004957 (CVE-2021-41072) - CVE-2021-41072 squashfs-tools: possible Directory Traversal via symbolic link
Summary: CVE-2021-41072 squashfs-tools: possible Directory Traversal via symbolic link
Status: NEW
Alias: CVE-2021-41072
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 2007304 2004958 2007302 2007303
Blocks: 2004960
TreeView+ depends on / blocked
Reported: 2021-09-16 13:48 UTC by Marian Rehak
Modified: 2021-10-07 15:44 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A directory traversal flaw was found in squashfs-tools. During extraction, a file can escape the destination directory by using a symbolic link, and a regular file with an identical name. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.
Clone Of:
Last Closed:

Attachments (Terms of Use)

Description Marian Rehak 2021-09-16 13:48:12 UTC
A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.

Upstream Issue:


Comment 1 Marian Rehak 2021-09-16 13:48:38 UTC
Created squashfs-tools tracking bugs for this issue:

Affects: fedora-all [bug 2004958]

Comment 6 Bruno Wolff III 2021-09-27 19:40:36 UTC
It is fixed in f35 and rawhide. I need to wait one more day before I can move from testing to stable in f33 and f34. The previous security fix didn't get into f33, because I didn't wait for the previous update to get to stable there before creating the new update and the older update got obsoleted.

Comment 8 Bruno Wolff III 2021-10-06 06:21:04 UTC
The fixed version is now in all current versions of Fedora.

Note You need to log in before you can comment on or make changes to this bug.