CVE-2021-41072
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
- EPSS
- 2.30% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22, CWE-59
- Affected
- squashfs-tools project/squashfs-tools · debian/debian linux
- Source
- cve@mitre.org
References
- https://github.com/plougher/squashfs-tools/commit/e0485802ec72996c20026da320650d8362f555bdPatch, Third Party Advisory
- https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/10/msg00017.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202305-29
- https://www.debian.org/security/2021/dsa-4987Third Party Advisory
- https://github.com/plougher/squashfs-tools/commit/e0485802ec72996c20026da320650d8362f555bdPatch, Third Party Advisory
- https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/10/msg00017.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202305-29
- https://www.debian.org/security/2021/dsa-4987Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.