CVE-2021-41072: Path Traversal
A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.
Upstream Issue:
https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405
Other sources
squashfsopendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/squashfs-toolsto a version that resolves this vulnerability.Fixed in 1:4.3-12+deb10u2Fixed in 1:4.4-2+deb11u2Fixed in 1:4.5.1-1Fixed in 1:4.6.1-1 - Upgrade
Upgrade
debian/squashfs-toolsto a version that resolves this vulnerability.Fixed in 1:4.5-3Fixed in 1:4.3-12+deb10u2Fixed in 1:4.4-2+deb11u2
Event History
Frequently Asked Questions
What is CVE-2021-41072 vulnerability?
CVE-2021-41072 is a high severity vulnerability in Squashfs-Tools 4.5 that allows directory traversal.
How does CVE-2021-41072 affect Squashfs-Tools?
CVE-2021-41072 allows an attacker to perform directory traversal in a squashfs filesystem.
What is the severity of CVE-2021-41072?
CVE-2021-41072 has a severity rating of 8.1 (high).
How do I fix CVE-2021-41072 in Squashfs-Tools?
To fix CVE-2021-41072, update Squashfs-Tools to version 1:4.3-12+deb10u2, 1:4.4-2+deb11u2, 1:4.5.1-1, or 1:4.6.1-1.
Where can I find more information about CVE-2021-41072?
You can find more information about CVE-2021-41072 at the following references: [reference 1](https://github.com/plougher/squashfs-tools/commit/e0485802ec72996c20026da320650d8362f555bd), [reference 2](https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405), [reference 3](https://lists.debian.org/debian-lts-announce/2021/10/msg00017.html).