CVE-2021-20291 Improper Locking in github.com/containers/storage
An attacker can cause a Denial of Service by crafting a malicious container image that triggers a deadlock in the containers/storage library during layer unpacking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-20291?
CVE-2021-20291 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 1 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).
Weakness: CWE-667
Which versions are affected by CVE-2021-20291?
3 open source packages ship an affected version, including github.com/containers/storage. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containers/storage Go | All versions | 1.28.1 |
github.com/containers/storage Go | All versions | 1.28.1 |
github.com/containers/storage Go | All versions | 1.28.1 |
Linux distribution packages (37)
buildah AlmaLinux:8 | All versions | 1.19.9-1.module_el8.5.0+2614+87221ce8 |
buildah-tests AlmaLinux:8 | All versions | 1.19.9-1.module_el8.5.0+2614+87221ce8 |
cockpit-podman AlmaLinux:8 | All versions | 29-2.module_el8.5.0+2614+87221ce8 |
cockpit-podman AlmaLinux:8 | All versions | 29-2.module_el8.6.0+2876+9ed4eae2 |
conmon AlmaLinux:8 | All versions | 2:2.0.26-1.module_el8.5.0+2614+87221ce8 |
conmon AlmaLinux:8 | All versions | 2:2.0.26-1.module_el8.6.0+2876+9ed4eae2 |
container-selinux AlmaLinux:8 | All versions | 2:2.167.0-1.module_el8.5.0+2614+87221ce8 |
containernetworking-plugins AlmaLinux:8 | All versions | 0.9.1-1.module_el8.5.0+2614+87221ce8 |
containernetworking-plugins AlmaLinux:8 | All versions | 0.9.1-1.module_el8.6.0+2876+9ed4eae2 |
containers-common AlmaLinux:8 | All versions | 1:1.2.4-1.module_el8.5.0+2614+87221ce8 |
containers-common AlmaLinux:8 | All versions | 1:1.2.4-1.module_el8.6.0+2876+9ed4eae2 |
crit AlmaLinux:8 | All versions | 3.15-1.module_el8.5.0+2614+87221ce8 |
crit AlmaLinux:8 | All versions | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
criu AlmaLinux:8 | All versions | 3.15-1.module_el8.5.0+2614+87221ce8 |
criu AlmaLinux:8 | All versions | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
crun AlmaLinux:8 | All versions | 0.18-2.module_el8.5.0+2614+87221ce8 |
fuse-overlayfs AlmaLinux:8 | All versions | 1.4.0-2.module_el8.5.0+2614+87221ce8 |
fuse-overlayfs AlmaLinux:8 | All versions | 1.4.0-2.module_el8.6.0+2876+9ed4eae2 |
libslirp AlmaLinux:8 | All versions | 4.3.1-1.module_el8.5.0+2614+87221ce8 |
libslirp AlmaLinux:8 | All versions | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 |
libslirp-devel AlmaLinux:8 | All versions | 4.3.1-1.module_el8.5.0+2614+87221ce8 |
libslirp-devel AlmaLinux:8 | All versions | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 |
oci-seccomp-bpf-hook AlmaLinux:8 | All versions | 1.2.0-3.module_el8.5.0+2614+87221ce8 |
oci-seccomp-bpf-hook AlmaLinux:8 | All versions | 1.2.0-3.module_el8.6.0+2876+9ed4eae2 |
podman AlmaLinux:8 | All versions | 3.0.1-7.module_el8.5.0+2614+87221ce8 |
podman-catatonit AlmaLinux:8 | All versions | 3.0.1-7.module_el8.5.0+2614+87221ce8 |
podman-docker AlmaLinux:8 | All versions | 3.0.1-7.module_el8.5.0+2614+87221ce8 |
podman-plugins AlmaLinux:8 | All versions | 3.0.1-7.module_el8.5.0+2614+87221ce8 |
podman-remote AlmaLinux:8 | All versions | 3.0.1-7.module_el8.5.0+2614+87221ce8 |
podman-tests AlmaLinux:8 | All versions | 3.0.1-7.module_el8.5.0+2614+87221ce8 |
python3-criu AlmaLinux:8 | All versions | 3.15-1.module_el8.5.0+2614+87221ce8 |
python3-criu AlmaLinux:8 | All versions | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
runc AlmaLinux:8 | All versions | 1.0.0-72.rc92.module_el8.5.0+2614+87221ce8 |
skopeo AlmaLinux:8 | All versions | 1:1.2.4-1.module_el8.5.0+2614+87221ce8 |
skopeo AlmaLinux:8 | All versions | 1:1.2.4-1.module_el8.6.0+2876+9ed4eae2 |
skopeo-tests AlmaLinux:8 | All versions | 1:1.2.4-1.module_el8.5.0+2614+87221ce8 |
skopeo-tests AlmaLinux:8 | All versions | 1:1.2.4-1.module_el8.6.0+2876+9ed4eae2 |
Products include Fedoraproject Fedora, Redhat Enterprise Linux, Redhat Openshift Container Platform, Storage Project Storage.
How do I fix CVE-2021-20291?
Upgrade github.com/containers/storage to 1.28.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-20291 being exploited?
There is no known exploitation of CVE-2021-20291 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALBA-2022:0348, AZL-44580, DEBIAN-CVE-2021-20291, GHSA-7qw8-847f-pggm, GO-2021-0100, RHBA-2022:0348 and 2 more.