Vulnerability Details : CVE-2021-41072
Potential exploit
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.
Vulnerability category: Directory traversal
Products affected by CVE-2021-41072
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- cpe:2.3:a:squashfs-tools_project:squashfs-tools:4.5:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-41072
3.59%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 87 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-41072
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:P |
8.6
|
4.9
|
NIST | |
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H |
2.8
|
5.2
|
NIST |
CWE ids for CVE-2021-41072
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: nvd@nist.gov (Primary)
-
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-41072
-
https://lists.debian.org/debian-lts-announce/2021/10/msg00017.html
[SECURITY] [DLA 2789-1] squashfs-tools security updateMailing List;Third Party Advisory
-
https://www.debian.org/security/2021/dsa-4987
Debian -- Security Information -- DSA-4987-1 squashfs-toolsThird Party Advisory
-
https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405
unsquashfs - unvalidated filepaths allow writing outside of destination · Issue #72 · plougher/squashfs-tools · GitHubExploit;Third Party Advisory
-
https://github.com/plougher/squashfs-tools/commit/e0485802ec72996c20026da320650d8362f555bd
Unsquashfs: additional write outside destination directory exploit fix · plougher/squashfs-tools@e048580 · GitHubPatch;Third Party Advisory
-
https://security.gentoo.org/glsa/202305-29
squashfs-tools: Multiple Vulnerabilities (GLSA 202305-29) — Gentoo security
Jump to