CVE-2021-40153: Path Traversal
squashfsopendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
Other sources
squashfsopendir in unsquash-1.c in Squashfs-Tools versions before 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
Reference: https://github.com/plougher/squashfs-tools/issues/72
Upstream patch: https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/squashfs-toolsto a version that resolves this vulnerability.Fixed in 1:4.3-12+deb10u2Fixed in 1:4.4-2+deb11u2Fixed in 1:4.5.1-1Fixed in 1:4.6.1-1 - Upgrade
Upgrade
redhat/squashfs-toolsto a version that resolves this vulnerability.Fixed in 4.5 - Upgrade
Upgrade
squashfs-toolsto a version that resolves this vulnerability.Fixed in 4.5Patch commit/79b5a555058eef4e1e7ff220c344d39f8cd09646
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-40153.
What is the severity of CVE-2021-40153?
The severity of CVE-2021-40153 is high with a CVSS score of 8.1.
Which software is affected by CVE-2021-40153?
The software affected by CVE-2021-40153 includes Squashfs-Tools version 4.5 and Debian Linux versions 9.0 and 10.0.
How does CVE-2021-40153 exploit work?
CVE-2021-40153 allows writing to locations outside of the destination directory by not validating the filename for traversal.
Is there a fix available for CVE-2021-40153?
Yes, the fix for CVE-2021-40153 is available. Please refer to the references for more information.