Link following in squashfs-tools - CVE-2021-41072

Vulnerability identifier: #VU57416

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-41072

CWE-ID: CWE-59

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to overwrite arbitrary files on the system.

The vulnerability exists due to a link following issue in squashfs_opendir in unsquash-2.c when processing a squashfs filesystem that has been crafted to include a symbolic link under the same filename in a filesystem. The attacker can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.

squashfs-tools
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
squashfs-tools (Debian package)
squashfs-tools (Ubuntu package)
squashfs-tools
squashfs-tools (Red Hat package)
squashfs-tools-debuginfo
squashfs-tools-debugsource
squashfs-tools-doc
squashfs
squashfs-debugsource
squashfs-debuginfo
Juniper Secure Analytics (JSA)
Red Hat OpenShift Container Platform

Install update from vendor's website.

squashfs-tools - update to 4.5.1
squashfs-tools (Debian package) - addressed in versions 1:4.3-12+deb10u2, 1:4.4-2+deb11u2
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
squashfs-tools (Ubuntu package) - addressed in versions 1:4.3-6ubuntu0.18.04.4, 1:4.4-1ubuntu0.2, 1:4.4-1ubuntu0.3, 1:4.4-2ubuntu0.2, 1:4.4-2ubuntu0.3, 1:4.33ubuntu2.16.04.3+esm1
squashfs-tools - addressed in versions 4.3-20.0.3, 4.6.1-1
squashfs-tools (Red Hat package) - addressed in versions 4.3-21.el8, 4.4-10.git1.el9
squashfs-tools - update to 4.4-5
squashfs-tools-debuginfo - update to 4.4-5
squashfs-tools-debugsource - update to 4.4-5
squashfs-tools-doc - update to 4.6.1-1
squashfs - addressed in versions 4.6.1-8.3.2, 4.6.1-150300.3.3.1
squashfs-debugsource - addressed in versions 4.6.1-8.3.2, 4.6.1-150300.3.3.1
squashfs-debuginfo - addressed in versions 4.6.1-8.3.2, 4.6.1-150300.3.3.1
Red Hat OpenShift Container Platform - addressed in versions 4.16.15, 4.17.0

• https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405
• https://github.com/plougher/squashfs-tools/commit/e0485802ec72996c20026da320650d8362f555bd
• https://www.debian.org/security/2021/dsa-4987

• Multiple vulnerabilities in Squashfs-Tools
• Debian update for squashfs-tools
• Ubuntu update for squashfs-tools
• Ubuntu update for squashfs-tools
• Ubuntu update for squashfs-tools
• Gentoo update for squashfs-tools
• SUSE update for squashfs
• SUSE update for squashfs
• openEuler update for squashfs-tools
• Red Hat Enterprise Linux 9 update for squashfs-tools
• Red Hat Enterprise Linux 8 update for squashfs-tools
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Anolis OS update for squashfs-tools
• Anolis OS update for squashfs-tools