CVE-2021-24032: Medium severity Facebook Zstandard vulnerability
Beginning in v1.4.1 and prior to v1.4.9 due to an incomplete fix for CVE-2021-24031 the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.
Other sources
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.
While the final file mode is reflective of the input file, when compressing or uncompressing, the file can temporarily gain greater permissions than the input and potentially leading to security issues (especially if large files are being handled).
References:
https://github.com/facebook/zstd/issues/2491 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/zstdto a version that resolves this vulnerability.Fixed in 1.4.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.2.2-5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.2.10-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.9-1 - Upgrade
Upgrade
zstd (Zstandard command-line utility)to a version that resolves this vulnerability.Fixed in 1.4.9 - Compensating control
Use a filesystem permission/containment control for zstd output during compress/uncompress (since output files can temporarily gain greater permissions) to prevent unintended parties from momentarily reading/writing the created output files.
Event History
Frequently Asked Questions
What is CVE-2021-24032?
CVE-2021-24032 is a vulnerability in the Zstandard command-line utility that creates output files with default permissions, which could momentarily make them readable or writable to unintended users.
What is the severity of CVE-2021-24032?
CVE-2021-24032 has a severity score of 4.7, which is classified as medium.
How does CVE-2021-24032 affect Facebook Zstandard?
CVE-2021-24032 affects Facebook Zstandard versions between 1.4.1 and 1.4.9.
Are there any known fixes for CVE-2021-24032?
Yes, updating to Facebook Zstandard version 1.4.9 or later fixes the vulnerability.
Where can I find more information about CVE-2021-24032?
You can find more information about CVE-2021-24032 on the Debian bug report, GitHub issue, and Facebook security advisory.