#VU57416 Link following in squashfs-tools - CVE-2021-41072

Vulnerability identifier: #VU57416

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-41072

CWE-ID: CWE-59

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
squashfs-tools
Other software / Other software solutions

Vendor: plougher

Description

The vulnerability allows a remote attacker to overwrite arbitrary files on the system.

The vulnerability exists due to a link following issue in squashfs_opendir in unsquash-2.c when processing a squashfs filesystem that has been crafted to include a symbolic link under the same filename in a filesystem. The attacker can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.

Mitigation
Install update from vendor's website.

Vulnerable software versions

squashfs-tools: 4.5

---

External links
https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405
https://github.com/plougher/squashfs-tools/commit/e0485802ec72996c20026da320650d8362f555bd
https://www.debian.org/security/2021/dsa-4987

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.