Improper locking in Storage - CVE-2021-20291

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU62797

Improper locking in Storage - CVE-2021-20291

Published: May 4, 2022


Vulnerability identifier: #VU62797
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-20291
CWE-ID: CWE-667
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform a denial of service attack (DoS) on the target system.

The vulnerability exists due to double-locking error. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).


Affected software

Storage
Oracle Linux
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
Fedora
crun
runc
skopeo
skopeo (Red Hat package)
containers-common
buildah
cri-o (Red Hat package)
buildah (Red Hat package)
conmon
container-selinux
podman
podman (Red Hat package)
openshift (Red Hat package)
libcontainers-common
Cloud Pak for Security (CP4S)
Red Hat OpenShift Container Platform

How to mitigate CVE-2021-20291

Install updates from vendor's website.

Storage - update to 1.28.1
crun - addressed in versions 0.19.1-2.fc33, 0.19.1-2.fc34
runc - addressed in versions 1.0.0-377.rc93.fc33, 1.0.0-377.rc93.fc34
skopeo - addressed in versions 1.2.3-1.fc33, 1.2.3-1.fc34
skopeo (Red Hat package) - update to 1.9.2-1.el9
Cloud Pak for Security (CP4S) - update to 1.10.12.0
containers-common - addressed in versions 1-15.fc33, 1-15.fc34
buildah - addressed in versions 1.20.1-2.fc33, 1.20.1-2.fc34, 1.20.1-4.fc33, 1.20.1-4.fc34
cri-o (Red Hat package) - addressed in versions 1.20.2-6.rhaos4.7.gitf1d5201.el7, 1.20.2-6.rhaos4.7.gitf1d5201.el8
buildah (Red Hat package) - update to 1.27.0-2.el9
conmon - update to 2.0.27-2.fc34
container-selinux - update to 2.160.0-2.fc34
podman - addressed in versions 3.1.2-1.fc33, 3.1.2-1.fc34
podman (Red Hat package) - update to 4.2.0-3.el9
openshift (Red Hat package) - addressed in versions 4.7.0-202104090228.p0.git.97111.77863f8.el7, 4.7.0-202104090228.p0.git.97111.77863f8.el8
Red Hat OpenShift Container Platform - update to 4.7.7
libcontainers-common - update to 20210626-150100.3.15.1

External References

Related Security Bulletins