CVE-2021-23177: High severity Libarchive libarchive vulnerability
An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.
Other sources
In libarchive before 3.5.2, when an archive entry contains a symbolic link that has defined ACLs on Linux, on extraction the ACLs of the link target are modified. This is because the function aclsetfile() is used without a prior check if the file is not a symbolic link. On Linux ACLs on symbolic links are not supported.
Reference: https://github.com/libarchive/libarchive/issues/1565
Upstream patch: https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F5 BIG-IP and BIG-IQ Centralized Managementto a version that resolves this vulnerability.Fixed in 8.4.0 - Upgrade
Upgrade
redhat/libarchiveto a version that resolves this vulnerability.Fixed in 3.5.2 - Upgrade
Upgrade
libarchiveto a version that resolves this vulnerability.Fixed in 3.5.2
Event History
Frequently Asked Questions
What is CVE-2021-23177?
CVE-2021-23177 is an improper link resolution flaw in Libarchive that can lead to changing the access control list (ACL) of the target of the link.
How does CVE-2021-23177 affect the software?
CVE-2021-23177 affects Libarchive with a version up to 3.5.2 and Fedora Project Fedora 35.
How can an attacker exploit CVE-2021-23177?
An attacker may provide a malicious archive to a victim user who would trigger this flaw when trying to extract the archive.
What is the severity of CVE-2021-23177?
CVE-2021-23177 has a severity rating of 7.8 (High).
How to fix CVE-2021-23177?
To fix CVE-2021-23177, users should update Libarchive to version 3.5.2 or newer.