CVE-2021-20319 coreos-installer improperly verifies GPG signature when decompressing gzipped artifact

High 7.8 Published 4 Mar 2022 Updated 3 Aug 2024

Attackers can bypass signature verification in coreos-installer to install unsigned content, gaining full access to the node.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-20319?

CVE-2021-20319 is a high-severity vulnerability in coreos-installer, published on 4 Mar 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.

Weakness: CWE-347

Which versions are affected by CVE-2021-20319?

3 open source packages ship an affected version, including coreos-installer. It affects 1 product.

Package	Affected	Fixed in
`coreos-installer` crates.io	All versions	`0.10.1`
`coreos-installer` crates.io	All versions	`0.10.1`
`coreos-installer` crates.io	From `0.0.0-0`	`0.10.1`

Linux distribution packages (20)

`coreos-installer` Red Hat:openshift:4.6::el8	All versions	`0:0.6.0-4.rhaos4.6.el8`
`coreos-installer-bootinfra` Red Hat:openshift:4.6::el8	All versions	`0:0.6.0-4.rhaos4.6.el8`
`coreos-installer-bootinfra-debuginfo` Red Hat:openshift:4.6::el8	All versions	`0:0.6.0-4.rhaos4.6.el8`
`coreos-installer-debuginfo` Red Hat:openshift:4.6::el8	All versions	`0:0.6.0-4.rhaos4.6.el8`
`coreos-installer-debugsource` Red Hat:openshift:4.6::el8	All versions	`0:0.6.0-4.rhaos4.6.el8`
`coreos-installer` Red Hat:openshift:4.7::el8	All versions	`0:0.8.0-4.rhaos4.7.el8`
`coreos-installer-bootinfra` Red Hat:openshift:4.7::el8	All versions	`0:0.8.0-4.rhaos4.7.el8`
`coreos-installer-bootinfra-debuginfo` Red Hat:openshift:4.7::el8	All versions	`0:0.8.0-4.rhaos4.7.el8`
`coreos-installer-debuginfo` Red Hat:openshift:4.7::el8	All versions	`0:0.8.0-4.rhaos4.7.el8`
`coreos-installer-debugsource` Red Hat:openshift:4.7::el8	All versions	`0:0.8.0-4.rhaos4.7.el8`
`coreos-installer` Red Hat:openshift:4.8::el8	All versions	`0:0.9.0-7.rhaos4.8.el8`
`coreos-installer-bootinfra` Red Hat:openshift:4.8::el8	All versions	`0:0.9.0-7.rhaos4.8.el8`
`coreos-installer-bootinfra-debuginfo` Red Hat:openshift:4.8::el8	All versions	`0:0.9.0-7.rhaos4.8.el8`
`coreos-installer-debuginfo` Red Hat:openshift:4.8::el8	All versions	`0:0.9.0-7.rhaos4.8.el8`
`coreos-installer-debugsource` Red Hat:openshift:4.8::el8	All versions	`0:0.9.0-7.rhaos4.8.el8`
`coreos-installer` Red Hat:openshift:4.9::el8	All versions	`0:0.10.1-1.rhaos4.9.el8`
`coreos-installer-bootinfra` Red Hat:openshift:4.9::el8	All versions	`0:0.10.1-1.rhaos4.9.el8`
`coreos-installer-bootinfra-debuginfo` Red Hat:openshift:4.9::el8	All versions	`0:0.10.1-1.rhaos4.9.el8`
`coreos-installer-debuginfo` Red Hat:openshift:4.9::el8	All versions	`0:0.10.1-1.rhaos4.9.el8`
`coreos-installer-debugsource` Red Hat:openshift:4.9::el8	All versions	`0:0.10.1-1.rhaos4.9.el8`

Products include Redhat Coreos-Installer.

How do I fix CVE-2021-20319?

Upgrade coreos-installer to 0.10.1 or later.

Is CVE-2021-20319 being exploited?

There is no known exploitation of CVE-2021-20319 in the wild and no public exploit code.

CVE-2021-3917 coreos-installer < 0.10.0 writes world-readable Ignition config to installed system Medium 5.5

Sources

Also known as GHSA-3r3g-g73x-g593, RHSA-2021:3926, RHSA-2021:3930, RHSA-2021:3934, RHSA-2021:4008, RUSTSEC-2022-0103.