774258 – (CVE-2021-24032) <app-arch/zstd-1.4.9: race condition allows attacker to read destination file (CVE-2021-24032)

Bug 774258 (CVE-2021-24032) - <app-arch/zstd-1.4.9: race condition allows attacker to read destination file (CVE-2021-24032)

Summary: <app-arch/zstd-1.4.9: race condition allows attacker to read destination file...

Status:	RESOLVED FIXED

Alias:	CVE-2021-24032

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://www.facebook.com/security/adv...
Whiteboard:	A4 [noglsa cleanup]
Keywords:

Depends on:
Blocks:

Reported:	2021-03-05 04:30 UTC by John Helmert III
Modified:	2021-03-31 08:08 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2021-03-05 04:30:43 UTC

CVE-2021-24032:

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.

Issue: https://github.com/facebook/zstd/issues/2491


Need to stabilize 1.4.9, if suitable.

Comment 1 Rolf Eike Beer archtester

2021-03-25 06:41:25 UTC

hppa stable

Comment 2 Sam James archtester

2021-03-25 23:13:38 UTC

amd64 done

Comment 3 Sam James archtester

2021-03-25 23:16:17 UTC

x86 done

Comment 4 Sam James archtester

2021-03-25 23:19:23 UTC

sparc done

Comment 5 Sam James archtester

2021-03-25 23:43:50 UTC

ppc done

Comment 6 Sam James archtester

2021-03-25 23:44:10 UTC

ppc64 done

Comment 7 Sam James archtester

2021-03-26 11:34:40 UTC

arm64 done

Comment 8 Agostino Sarubbo gentoo-dev

2021-03-26 11:50:52 UTC

s390 stable

Comment 9 Sam James archtester

2021-03-27 16:05:06 UTC

arm done

all arches done

Comment 10 John Helmert III archtester

2021-03-27 16:56:13 UTC

Please cleanup

Comment 11 Larry the Git Cow gentoo-dev

2021-03-31 08:06:40 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fe4310bcbcacb83aa15d13bb28919e6faea0f44b

commit fe4310bcbcacb83aa15d13bb28919e6faea0f44b
Author:     Mikle Kolyada <zlogene@gentoo.org>
AuthorDate: 2021-03-31 08:06:20 +0000
Commit:     Mikle Kolyada <zlogene@gentoo.org>
CommitDate: 2021-03-31 08:06:37 +0000

    app-arch/zstd: Security cleanup
    
    Bug: https://bugs.gentoo.org/774258
    Package-Manager: Portage-3.0.17, Repoman-3.0.2
    Signed-off-by: Mikle Kolyada <zlogene@gentoo.org>

 app-arch/zstd/Manifest                             |   3 -
 app-arch/zstd/files/zstd-1.4.4-make43.patch        |  60 ------
 .../zstd/files/zstd-1.4.4-pkgconfig_libdir.patch   | 215 ---------------------
 app-arch/zstd/files/zstd-1.4.5-fix-uclibc-ng.patch |  28 ---
 app-arch/zstd/zstd-1.4.4-r4.ebuild                 |  75 -------
 app-arch/zstd/zstd-1.4.5.ebuild                    |  73 -------
 app-arch/zstd/zstd-1.4.8-r1.ebuild                 |  69 -------
 7 files changed, 523 deletions(-)

Comment 12 Mikle Kolyada (RETIRED) archtester

2021-03-31 08:08:29 UTC

GLSA vote: no.