UNIX symbolic link following in umoci - CVE-2021-29136

Vulnerability identifier: #VU51962

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-29136

CWE-ID: CWE-61

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a symlink following issue when processing crafted images. A remote attacker can create a specially crafted image with symbolic link to a critical file on the system and overwrite it, when "umoci unpack" or "umoci raw unpack" is used.

Successful exploitation of this vulnerability may result in privilege escalation.

umoci
Singularity
SUSE Manager Retail Branch Server
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Containers
SUSE Linux Enterprise Module for Basesystem
openEuler
umoci
umoci-help

Install updates from vendor's website.

umoci - update to 0.4.7
Singularity - update to 3.7.3
umoci - update to 0.4.5-4
umoci-help - update to 0.4.5-4
umoci - addressed in versions 0.4.6-3.9.1, 0.4.7-3.12.1

• http://www.openwall.com/lists/oss-security/2021/04/06/2
• https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57
• https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v

• Arbitrary file overwrite in Open Container Initiative umoci
• Singularity update for umoci
• SUSE update for umoci
• SUSE update for umoci
• SUSE update for umoci
• openEuler 20.03 LTS SP1 update for umoci