CVE-2021-20319
published 2022-03-04CVE-2021-20319: An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature…
PriorityP339high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.52%
40.3th percentile
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | coreos-installer | < 0.10.1 | 0.10.1 |
| redhat | coreos-installer | — | — |
| redhat | coreos-installer | >= 0 < 0.10.1 | 0.10.1 |
| redhat | coreos-installer | >= 0.0.0-0 < 0.10.1 | 0.10.1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Incorrect signature verification on gzip-compressed install images
osv·2022-03-04
CVE-2021-20319 Incorrect signature verification on gzip-compressed install images
Incorrect signature verification on gzip-compressed install images
The coreos-installer is a program to fetch a disk image and
stream it to a target disk.
During the installation process the installation image gpg
signatures are verified.
The signature verification can be bypassed for gzip-compressed
images due to a flaw in gzip coreos-installer wrapper.
When the decoder encounters the gzip trailer, it signals EOF
to its output and does not continue reading from its input.
As a result, earlier wrappers don't notice that they've reached
EOF.
In particular, the GPG wrapper does not check the exit code of GPG.
Thus, if an attacker can substitute an attacker-controlled
gzipped disk image, installation will complete successfully
without a valid signature.
This vulnerability impacts only
GHSA
coreos-installer improperly verifies GPG signature when decompressing gzipped artifact
ghsa·2021-10-12
CVE-2021-20319 [HIGH] CWE-347 coreos-installer improperly verifies GPG signature when decompressing gzipped artifact
coreos-installer improperly verifies GPG signature when decompressing gzipped artifact
### Impact
coreos-installer fails to correctly verify GPG signatures when decompressing gzip-compressed artifacts. This allows bypass of signature verification in cases where coreos-installer decompresses a downloaded OS image, allowing an attacker who can modify the OS image to compromise a newly-installed system.
Default installations from ISO or PXE media in Fedora CoreOS, RHEL CoreOS, and RHEL for Edge are **not** affected, as coreos-installer installs from an OS image shipped as part of the install media.
These flows are affected:
1. Installing with `--image-file`, `--image-url`, or `coreos.inst.image_url`. For example, if a user has a local mirror of installation images, an attacker could repl
OSV
coreos-installer improperly verifies GPG signature when decompressing gzipped artifact
osv·2021-10-12
CVE-2021-20319 [HIGH] coreos-installer improperly verifies GPG signature when decompressing gzipped artifact
coreos-installer improperly verifies GPG signature when decompressing gzipped artifact
### Impact
coreos-installer fails to correctly verify GPG signatures when decompressing gzip-compressed artifacts. This allows bypass of signature verification in cases where coreos-installer decompresses a downloaded OS image, allowing an attacker who can modify the OS image to compromise a newly-installed system.
Default installations from ISO or PXE media in Fedora CoreOS, RHEL CoreOS, and RHEL for Edge are **not** affected, as coreos-installer installs from an OS image shipped as part of the install media.
These flows are affected:
1. Installing with `--image-file`, `--image-url`, or `coreos.inst.image_url`. For example, if a user has a local mirror of installation images, an attacker could repl
Red Hat
coreos-installer: incorrect signature verification on gzip-compressed install images
vendor_redhat·2021-10-07·CVSS 7.8
CVE-2021-20319 [HIGH] CWE-347 coreos-installer: incorrect signature verification on gzip-compressed install images
coreos-installer: incorrect signature verification on gzip-compressed install images
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=2011862https://github.com/coreos/coreos-installer/pull/659/commits/ad243c6f0eff2835b2da56ca5f7f33af76253c89https://github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593https://bugzilla.redhat.com/show_bug.cgi?id=2011862https://github.com/coreos/coreos-installer/pull/659/commits/ad243c6f0eff2835b2da56ca5f7f33af76253c89https://github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593
2022-03-04
Published