810706 – (CVE-2021-40153) <sys-fs/squashfs-tools-4.5: directory traversal (CVE-2021-40153)

Bug 810706 (CVE-2021-40153) - <sys-fs/squashfs-tools-4.5: directory traversal (CVE-2021-40153)

Summary: <sys-fs/squashfs-tools-4.5: directory traversal (CVE-2021-40153)

Status:	RESOLVED FIXED

Alias:	CVE-2021-40153

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal normal (vote)
Assignee:	Gentoo Security

URL:	https://github.com/plougher/squashfs-...
Whiteboard:	B2 [glsa+]
Keywords:

Depends on:	810709
Blocks:
	Show dependency tree

Reported:	2021-08-27 19:46 UTC by John Helmert III
Modified:	2023-05-30 03:00 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2021-08-27 19:46:22 UTC

CVE-2021-40153:

squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.

Patch: https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646

Comment 1 John Helmert III archtester

2021-08-27 19:51:40 UTC

Please file a stablereq when ready. Patch is in 4.5.

Comment 2 John Helmert III archtester

2021-09-04 21:55:54 UTC

Please cleanup.

Comment 3 Michał Górny archtester

2021-09-04 22:07:55 UTC

cleanup done.

Comment 4 John Helmert III archtester

2023-05-29 23:42:51 UTC

GLSA request filed

Comment 5 Larry the Git Cow gentoo-dev

2023-05-30 02:56:47 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=7c5aee9146a9230980d95e7d2037c660f20dd275

commit 7c5aee9146a9230980d95e7d2037c660f20dd275
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-05-30 02:54:28 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2023-05-30 02:56:35 +0000

    [ GLSA 202305-29 ] squashfs-tools: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/810706
    Bug: https://bugs.gentoo.org/813654
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202305-29.xml | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

Comment 6 John Helmert III archtester

2023-05-30 03:00:02 UTC

GLSA released, all done!