Incorrect default permissions in Zstandard - CVE-2021-24032

Vulnerability identifier: #VU51640

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-24032

CWE-ID: CWE-276

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application within the command-line utility. A remote attacker can view contents of files and directories or modify them.

Zstandard
cflinuxfs3
SUSE MicroOS
SUSE Linux Enterprise Module for Basesystem
Ubuntu
openEuler
CF Deployment
zstd (Ubuntu package)
libzstd1 (Ubuntu package)
libzstd1
libzstd1-debuginfo
zstd-debuginfo
zstd-debugsource
libzstd-devel
zstd
libzstd1-32bit
libzstd1-32bit-debuginfo
zstd-help
zstd-devel
AMQ Streams

Install updates from vendor's website.

Zstandard - update to 1.4.9
cflinuxfs3 - update to 0.228.0
CF Deployment - update to 16.7.0
zstd (Ubuntu package) - addressed in versions 1.3.1+dfsg-1~ubuntu0.16.04.1+esm3, 1.3.3+dfsg-2ubuntu1.2, 1.4.4+dfsg-3ubuntu0.1, 1.4.5+dfsg-4ubuntu0.1
libzstd1 (Ubuntu package) - addressed in versions 1.3.1+dfsg-1~ubuntu0.16.04.1+esm3, 1.3.3+dfsg-2ubuntu1.2, 1.4.4+dfsg-3ubuntu0.1, 1.4.5+dfsg-4ubuntu0.1
libzstd1 - update to 1.4.4-1.6.1
libzstd1-debuginfo - update to 1.4.4-1.6.1
zstd-debuginfo - update to 1.4.4-1.6.1
zstd-debugsource - update to 1.4.4-1.6.1
libzstd-devel - update to 1.4.4-1.6.1
zstd - update to 1.4.4-1.6.1
libzstd1-32bit - update to 1.4.4-1.6.1
libzstd1-32bit-debuginfo - update to 1.4.4-1.6.1
zstd-help - update to 1.4.5-1
zstd-devel - update to 1.4.5-1
zstd-debugsource - update to 1.4.5-1
zstd-debuginfo - update to 1.4.5-1
zstd - update to 1.4.5-1
AMQ Streams - update to 2.7.0

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519
• https://github.com/facebook/zstd/issues/2491
• https://www.facebook.com/security/advisories/cve-2021-24032

• Incorrect default permissions in Facebook Zstandard
• Multiple vulnerabilities in Cloud Foundry cflinuxfs3 and CF Deployment
• Ubuntu update for libzstd
• Ubuntu update for libzstd
• SUSE update for zstd
• openEuler update for zstd
• Multiple vulnerabilities in AMQ Streams 2.7