Vulnerability Details : CVE-2021-20291
Potential exploit
A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).
Vulnerability category: Denial of service
Products affected by CVE-2021-20291
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- cpe:2.3:a:storage_project:storage:*:*:*:*:*:*:*:*
Threat overview for CVE-2021-20291
Top countries where our scanners detected CVE-2021-20291
Top open port discovered on systems with this issue
53
IPs affected by CVE-2021-20291 57,088
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2021-20291!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2021-20291
0.43%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 74 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-20291
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.1
|
HIGH | AV:N/AC:M/Au:N/C:N/I:N/A:C |
8.6
|
6.9
|
NIST | |
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2021-20291
-
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.Assigned by: secalert@redhat.com (Primary)
References for CVE-2021-20291
-
https://bugzilla.redhat.com/show_bug.cgi?id=1939485
1939485 – (CVE-2021-20291) CVE-2021-20291 containers/storage: DoS via malicious imageIssue Tracking;Patch;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPYOHNG2Q7DCAQZMGYLMENLKALGDLG3X/
[SECURITY] Fedora 33 Update: skopeo-1.2.3-1.fc33 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNMB7O2UIXE34PGSCSOULGHPX5LIJBMM/
[SECURITY] Fedora 34 Update: runc-1.0.0-377.rc93.fc34 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://unit42.paloaltonetworks.com/cve-2021-20291/
New Vulnerability Affecting Container Engines CRI-O and Podman (CVE-2021-20291)Exploit;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R5D7XL7FL24TWFMGQ3K2S72EOUSLZMKL/
[SECURITY] Fedora 33 Update: buildah-1.20.1-4.fc33 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WX24EITRXVHDM5M223BVTJA2ODF2FSHI/
[SECURITY] Fedora 34 Update: skopeo-1.2.3-1.fc34 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
Jump to