PT-2021-1402 · Unknown+7 · Containers/Storage+7

Aviv Sasson · Published 2021-04-01 · Updated 2024-06-15 · CVE-2021-20291

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: github.com/containers/storage versions prior to 1.28.1

Description: A deadlock issue occurs when processing a container image with an invalid tar archive layer, causing the code to wait indefinitely for the tar unpacked stream. This can be exploited by an attacker to craft a malicious image, leading to a Denial of Service (DoS) when downloaded and stored by an application using containers/storage.

Recommendations: For versions prior to 1.28.1, update to version 1.28.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the github.com/containers/storage module until a patch is available. Avoid using the DecompressStream function on untrusted archives to minimize the risk of exploitation.

Exploit

Fix

DoS

Resource Exhaustion

Improper Locking

Weakness Enumeration

CWE-400

CWE-667

Related Identifiers

ALBA-2022:0348

ALSA-2021:4154

ALSA-2021_4154

ALSA-2022:7954

ALSA-2022:7955

ALSA-2022:8008

ALSA-2022_7955

ALSA-2022_8008

ALT-PU-2022-1252

AZL-44580

CESA-2021_4154

CVE-2021-20291

ELSA-2021-4154

ELSA-2022-7954

ELSA-2022-7955

ELSA-2022-8008

GHSA-7QW8-847F-PGGM

GO-2021-0100

MGASA-2023-0213

OPENSUSE-SU-2022:23018-1

OPENSUSE-SU-2022_23018-1

OPENSUSE-SU-2024:11757-1

RHSA-2021:1150

RHSA-2021:4154

RHSA-2021_4154

RHSA-2022:7954

RHSA-2022:7955

RHSA-2022:8008

RHSA-2022_7954

RHSA-2022_7955

RHSA-2022_8008

RLSA-2021:4154

RLSA-2021_4154

SUSE-SU-2022:23018-1

SUSE-SU-2022:3312-1

SUSE-SU-2022_23018-1

SUSE-SU-2022_3312-1

Affected Products

Alt Linux

Almalinux

Centos

Debian

Red Hat

Rocky Linux

Suse

Containers/Storage

References · 200

• 🔥 https://github.com/alexzorin/cve-2021-34558 · Exploit
• 🔥 https://unit42.paloaltonetworks.com/cve-2021-20291 · Exploit
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/IKOQ2O3CAYO75ZV2PUCTL6G72K7JVGCT · Vendor Advisory
• https://osv.dev/vulnerability/ALBA-2022:0348 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4154 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1939485 · Patch
• https://osv.dev/vulnerability/GHSA-7qw8-847f-pggm · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:7955 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:23018-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ZNMB7O2UIXE34PGSCSOULGHPX5LIJBMM · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/GWKDCFQ4EVHMJJ6V2EAABHSRZK34HUUT · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/I5RR5DUZHU2FFOE3EKYH6T74SA43EB4T · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:4154 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/XNDJJ36ISNZQL6I3K25POE5HZZJYUEIV · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-20291 · Vendor Advisory