Multiple vulnerabilities in Squashfs-Tools

Published: 2021-09-05 | Updated: 2022-03-18

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2021-40153 CVE-2021-41072
CWE-ID	CWE-22 CWE-59
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	squashfs-tools Other software / Other software solutions
Vendor	plougher

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

Updated: 18.10.2021

Added vulnerability #2.

Updated 18.3.2022

Added fixed version for vulnerabilities #1-2

1) Path traversal

EUVDB-ID: #VU56306

Risk: Medium

CVSSv3.1: 7.4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2021-40153

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences within the squashfs_opendir in unsquash-1.c. A remote user can store the filename in the directory entry, which later is used by unsquashfs to create the new file during the unsquash. As a result, it is possible to write files to locations outside of the destination.

Mitigation

Install update from vendor's website.

Vulnerable software versions

squashfs-tools: 4.4 - 4.5

External links

http://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790
http://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646
http://github.com/plougher/squashfs-tools/issues/72
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/
http://lists.debian.org/debian-lts-announce/2021/08/msg00030.html
http://www.debian.org/security/2021/dsa-4967

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Link following

EUVDB-ID: #VU57416

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-41072

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Exploit availability: No

Description

The vulnerability allows a remote attacker to overwrite arbitrary files on the system.

The vulnerability exists due to a link following issue in squashfs_opendir in unsquash-2.c when processing a squashfs filesystem that has been crafted to include a symbolic link under the same filename in a filesystem. The attacker can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.