CVE-2021-20291 — Improper Locking in Containers Storage

CWE-667 — Improper LockingCWE-400 — Uncontrolled Resource Consumption10 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
1.0%
top 22.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Github.com Containers StorageStorage Project StorageContainers Storage+3 more
Timeline
PublishedApr 1
Latest updateJul 28

Description

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5containers/storagecontainers/storage 1.28.1

Also affects: Openshift Container Platform 4.0, Fedora 33, 34, Enterprise Linux 8.0

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

5
OSV
Denial of service via deadlock in github.com/containers/storage↗2021-07-28
▶
GHSA
Improper Locking in github.com/containers/storage↗2021-05-10
▶
OSV
Improper Locking in github.com/containers/storage↗2021-05-10
▶
OSV
CVE-2021-20291: A deadlock vulnerability was found in 'github↗2021-04-01
▶
CVEList
CVE-2021-20291: A deadlock vulnerability was found in 'github↗2021-04-01
▶

📋Vendor Advisories

2
Red Hat
containers/storage: DoS via malicious image↗2021-04-01
▶
Debian
CVE-2021-20291: golang-github-containers-storage - A deadlock vulnerability was found in 'github.com/containers/storage' in version...↗2021
▶

🕵️Threat Intelligence

2
Unit42
New Vulnerability Affecting Container Engines CRI-O and Podman (CVE-2021-20291)↗2021-04-14
▶
Unit42
New Vulnerability Affecting Container Engines CRI-O and Podman (CVE-2021-20291)↗2021-04-14
▶
CVE-2021-20291 — Improper Locking in Containers Storage | cvebase