CVE-2021-23177: High severity oracle libarchive vulnerability
An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.
Other sources
In libarchive before 3.5.2, when an archive entry contains a symbolic link that has defined ACLs on Linux, on extraction the ACLs of the link target are modified. This is because the function aclsetfile() is used without a prior check if the file is not a symbolic link. On Linux ACLs on symbolic links are not supported.
Reference: https://github.com/libarchive/libarchive/issues/1565
Upstream patch: https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-23177?
CVE-2021-23177 is an improper link resolution flaw in Libarchive that can lead to changing the access control list (ACL) of the target of the link.
How does CVE-2021-23177 affect the software?
CVE-2021-23177 affects Libarchive with a version up to 3.5.2 and Fedora Project Fedora 35.
How can an attacker exploit CVE-2021-23177?
An attacker may provide a malicious archive to a victim user who would trigger this flaw when trying to extract the archive.
What is the severity of CVE-2021-23177?
CVE-2021-23177 has a severity rating of 7.8 (High).
How to fix CVE-2021-23177?
To fix CVE-2021-23177, users should update Libarchive to version 3.5.2 or newer.