CVE-2021-41072 Information

Description

squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Reference

https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405 https://github.com/plougher/squashfs-tools/commit/e0485802ec72996c20026da320650d8362f555bd https://www.debian.org/security/2021/dsa-4987 https://lists.debian.org/debian-lts-announce/2021/10/msg00017.html

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.1