Bug 2004957 (CVE-2021-41072) - CVE-2021-41072 squashfs-tools: possible Directory Traversal via symbolic link
Summary: CVE-2021-41072 squashfs-tools: possible Directory Traversal via symbolic link
Keywords:
Status: NEW
Alias: CVE-2021-41072
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2007303 2007304 2004958 2007302
Blocks: 2004960
TreeView+ depends on / blocked
 
Reported: 2021-09-16 13:48 UTC by Marian Rehak
Modified: 2023-07-07 08:27 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A directory traversal flaw was found in squashfs-tools. During extraction, a file can escape the destination directory by using a symbolic link, and a regular file with an identical name. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description Marian Rehak 2021-09-16 13:48:12 UTC
A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.

Upstream Issue:

https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405

Comment 1 Marian Rehak 2021-09-16 13:48:38 UTC
Created squashfs-tools tracking bugs for this issue:

Affects: fedora-all [bug 2004958]

Comment 6 Bruno Wolff III 2021-09-27 19:40:36 UTC
It is fixed in f35 and rawhide. I need to wait one more day before I can move from testing to stable in f33 and f34. The previous security fix didn't get into f33, because I didn't wait for the previous update to get to stable there before creating the new update and the older update got obsoleted.

Comment 8 Bruno Wolff III 2021-10-06 06:21:04 UTC
The fixed version is now in all current versions of Fedora.


Note You need to log in before you can comment on or make changes to this bug.