Improper Validation of Array Index in Protobuf - CVE-2021-3121

Vulnerability identifier: #VU52902

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3121

CWE-ID: CWE-129

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper validation of index array in plugin/unmarshal/unmarshal.go. A remote attacker can pass specially crafted data to the application and bypass implemented security restrictions, possibly leading to remote code execution.

Protobuf
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE CaaS Platform
SUSE Enterprise Storage
openSUSE Leap
Cryostat
Red Hat Advanced Cluster Management for Kubernetes
IBM Security Guardium Insights
OpenShift Logging
IBM Robotic Process Automation
Netcool Operations Insight
DB2 Data Management Console
DB2 Data Management Console on CPD
IBM Watson Machine Learning Accelerator
IBM Cloud Pak for Watson AIOps
Storage Ceph
IBM Edge Application Manager
Red Hat OpenShift Container Platform
Dell EMC Container Storage Modules
Migration Toolkit for Containers
AMQ Broker
toolbox (Red Hat package)
coreos-installer (Red Hat package)
python-openshift (Red Hat package)
butane (Red Hat package)
python-pyrsistent (Red Hat package)
console-login-helper-messages (Red Hat package)
python-eventlet (Red Hat package)
python-hardware (Red Hat package)
python-openstacksdk (Red Hat package)
runc (Red Hat package)
python-oslo-upgradecheck (Red Hat package)
rteval-loads (Red Hat package)
kubernetes-1.18-kubeadm
kubernetes-1.18-kubelet
kubernetes1.18-client-common
kubernetes1.18-client
cri-o (Red Hat package)
cri-tools (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
kata-containers (Red Hat package)
skuba-update
skuba
python-debtcollector (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
haproxy (Red Hat package)
python-oslo-service (Red Hat package)
python-tooz (Red Hat package)
ignition (Red Hat package)
openvswitch2.15 (Red Hat package)
jenkins (Red Hat package)
podman (Red Hat package)
python-oslo-context (Red Hat package)
python-jsonschema (Red Hat package)
python-stevedore (Red Hat package)
python-oslo-policy (Red Hat package)
python-sushy (Red Hat package)
python-oslo-serialization (Red Hat package)
python-keystoneauth1 (Red Hat package)
python-oslo-concurrency (Red Hat package)
python-oslo-log (Red Hat package)
caasp-release
release-notes-caasp
python-ironic-lib (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-clients (Red Hat package)
jenkins-2-plugins (Red Hat package)
python-oslo-utils (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-ansible (Red Hat package)
openshift (Red Hat package)
rust-afterburn (Red Hat package)
python-oslo-i18n (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
python-oslo-db (Red Hat package)
python-oslo-config (Red Hat package)
openstack-ironic-inspector (Red Hat package)
python-kubernetes (Red Hat package)
openstack-ironic (Red Hat package)
ovn2.13 (Red Hat package)
redhat-release-coreos (Red Hat package)
ostree (Red Hat package)
ironic-images (Red Hat package)
OpenShift Virtualization

Install updates from vendor's website.

Protobuf - update to 1.3.2
Cryostat - update to 2.1.0
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.0.8, 2.1.3, 2.1.6, 2.2.2
IBM Security Guardium Insights - update to 3.0
DB2 Data Management Console - update to 3.1.13.1
Red Hat OpenShift Container Platform - addressed in versions 4.7.5, 4.7.8, 4.7.9, 4.7.11, 4.7.12, 4.7.23, 4.7.28, 4.7.29, 4.7.42, 4.8.2, 4.10.30, 4.11.5
DB2 Data Management Console on CPD - update to 5.1.2
OpenShift Logging - update to 5.0.5
AMQ Broker - update to 7.10.1
IBM Robotic Process Automation - update to 21.0.2.5
toolbox (Red Hat package) - update to 0.0.8-3.rhaos4.8.el8
coreos-installer (Red Hat package) - update to 0.9.0-6.rhaos4.8.el8
python-openshift (Red Hat package) - update to 0.12.1-1.el8
butane (Red Hat package) - update to 0.12.1-1.rhaos4.8.el8
python-pyrsistent (Red Hat package) - update to 0.16.0-3.el8ost
console-login-helper-messages (Red Hat package) - update to 0.20.3-1.rhaos4.8.el8
python-eventlet (Red Hat package) - update to 0.25.2-4.el8
python-hardware (Red Hat package) - update to 0.27.0-0.20210406121246.756fedb.el8
python-openstacksdk (Red Hat package) - update to 0.53.0-0.20210325011601.4629245.el8
runc (Red Hat package) - addressed in versions 1.0.0-98.rhaos4.8.gitcd80260.el7, 1.0.0-98.rhaos4.8.gitcd80260.el8
Dell EMC Container Storage Modules - update to 1.0.1
python-oslo-upgradecheck (Red Hat package) - update to 1.3.0-0.20210325003851.9f95a6e.el8
rteval-loads (Red Hat package) - update to 1.4-12.el8
Migration Toolkit for Containers - update to 1.5.1
Netcool Operations Insight - update to 1.6.7
kubernetes-1.18-kubeadm - update to 1.18.20-4.11.3
kubernetes-1.18-kubelet - update to 1.18.20-4.11.3
kubernetes1.18-client-common - update to 1.18.20-150200.5.25.1
kubernetes1.18-client - update to 1.18.20-150200.5.25.1
cri-o (Red Hat package) - addressed in versions 1.20.2-4.rhaos4.7.gitd5a999a.el7, 1.20.2-4.rhaos4.7.gitd5a999a.el8, 1.21.2-5.rhaos4.8.gitb27d974.el7, 1.21.2-5.rhaos4.8.gitb27d974.el8
cri-tools (Red Hat package) - addressed in versions 1.21.0-2.el7, 1.21.0-2.el8
python-sushy-oem-idrac (Red Hat package) - update to 2.0.1-0.20210326152858.83b7eb0.el8
kata-containers (Red Hat package) - update to 2.1.0-4.el8
skuba-update - update to 2.1.15-3.15.13.2
skuba - update to 2.1.15-3.15.13.2
python-debtcollector (Red Hat package) - update to 2.2.0-0.20210324220630.649189d.el8
python-ironic-prometheus-exporter (Red Hat package) - update to 2.2.1-0.20210325143713.70e39c8.el8
haproxy (Red Hat package) - addressed in versions 2.2.13-1.el7, 2.2.13-1.el8
IBM Watson Machine Learning Accelerator - update to 2.3.9
python-oslo-service (Red Hat package) - update to 2.5.0-0.20210325014731.d25e454.el8
python-tooz (Red Hat package) - update to 2.8.0-0.20210324235001.54448e9.el8
ignition (Red Hat package) - update to 2.9.0-6.rhaos4.8.el8
openvswitch2.15 (Red Hat package) - update to 2.15.0-9.el8fdp
jenkins (Red Hat package) - update to 2.289.1.1624020353-1.el8
podman (Red Hat package) - update to 3.0.1-6.el8
python-oslo-context (Red Hat package) - update to 3.2.0-0.20210325043103.0d02866.el8
python-jsonschema (Red Hat package) - update to 3.2.0-5.el8ost
python-stevedore (Red Hat package) - update to 3.3.0-0.20210325001012.7d7154f.el8
python-oslo-policy (Red Hat package) - update to 3.7.0-0.20210325051823.d853485.el8
python-sushy (Red Hat package) - update to 3.7.1-0.20210428165244.bc49878.el8
IBM Cloud Pak for Watson AIOps - update to 4.1
python-oslo-serialization (Red Hat package) - update to 4.1.0-0.20210325012242.8445e61.el8
python-keystoneauth1 (Red Hat package) - update to 4.3.0-0.20210325001456.6a66271.el8
python-oslo-concurrency (Red Hat package) - update to 4.4.0-0.20210325004915.7dcf9e9.el8
python-oslo-log (Red Hat package) - update to 4.4.0-0.20210409081224.9b29c90.el8
caasp-release - update to 4.5.5-1.19.3
release-notes-caasp - update to 4.5.20210907-3.22.3
python-ironic-lib (Red Hat package) - update to 4.6.2-0.20210608101214.ca2e4ba.el8
openshift-kuryr (Red Hat package) - addressed in versions 4.7.0-202103241948.p0.git.2504.add19d0.el8, 4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.7.0-202103251046.p0.git.3957.c4da68b.el7, 4.7.0-202103251046.p0.git.3957.c4da68b.el8, 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el7, 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - addressed in versions 4.7.1616671397-1.el8, 4.8.1624022417-1.el8
OpenShift Virtualization - addressed in versions 4.8.0, 4.8.1, 4.9.0
python-oslo-utils (Red Hat package) - update to 4.8.0-0.20210325043201.3288539.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8
openshift-ansible (Red Hat package) - update to 4.8.0-202106281541.p0.git.626f7a3.assembly.stream.el7
openshift (Red Hat package) - addressed in versions 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7, 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8
rust-afterburn (Red Hat package) - update to 5.0.0-1.rhaos4.8.el8
python-oslo-i18n (Red Hat package) - update to 5.0.1-0.20210324221600.73187bd.el8
openstack-ironic-python-agent (Red Hat package) - update to 7.0.2-0.20210611153100.bfa97cb.el8
Storage Ceph - update to 7.1
python-oslo-db (Red Hat package) - update to 8.5.0-0.20210325041241.503db60.el8
python-oslo-config (Red Hat package) - update to 8.5.0-0.20210325050501.cfa2564.el8
openstack-ironic-inspector (Red Hat package) - update to 10.6.1-0.20210406091336.579f59c.el8
python-kubernetes (Red Hat package) - update to 12.0.1-1.el8
openstack-ironic (Red Hat package) - update to 17.0.4-0.20210713221218.a415e7e.el8
ovn2.13 (Red Hat package) - update to 20.12.0-25.el8fdp
redhat-release-coreos (Red Hat package) - update to 48.84-4.el8
ostree (Red Hat package) - update to 2020.7-5.el8_4
ironic-images (Red Hat package) - update to 2021.1-20210614.1.el8

• https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc
• https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2
• https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e@%3Ccommits.pulsar.apache.org%3E
• https://lists.apache.org/thread.html/rc1e9ff22c5641d73701ba56362fb867d40ed287cca000b131dcf4a44@%3Ccommits.pulsar.apache.org%3E
• https://security.netapp.com/advisory/ntap-20210219-0006/

• Improper validation of array index in GoGo Protobuf
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Improper validation of array index in OpenShift Container Platform
• Multiple vulnerabilities in Openshift Logging
• Remote code execution in OpenShift Container Platform
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers
• Multiple vulnerabilities in OpenShift Container Platform 4.7
• Remote code execution in OpenShift Container Platform 4.7
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in OpenShift Container Platform 4.7
• Multiple vulnerabilities in Cryostat
• SUSE update for Includes a kubernetes update to 1.18.20 including a backport for CVE-2021-25741
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Red Hat AMQ Broker 7.10
• Improper validation of array index in in Dell EMC Container Storage Modules
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Storage Ceph
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.1
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.0
• Improper Validation of Array Index in Red Hat OpenShift Container Platform 4.7
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.7
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.7
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.7
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.8 packages
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in IBM Security Guardium Insights
• Multiple vulnerabilities in IBM DB2 Data Management Console
• SUSE update for kubernetes1.18
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.2