Vulnerability-Lookup

CVE-2021-29136 (GCVE-0-2021-29136)

Vulnerability from cvelistv5 – Published: 2021-04-06 15:57 – Updated: 2024-08-03 22:02

Summary

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE

Assigner

mitre mitre root

References

3 references

URL	Tags
http://www.openwall.com/lists/oss-security/2021/04/06/2	x_refsource_MISC
https://github.com/opencontainers/umoci/security/…	x_refsource_CONFIRM
https://github.com/opencontainers/umoci/commit/d9…	x_refsource_CONFIRM

Date Public

2021-04-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T22:02:50.955Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/04/06/2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2021-04-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when \"umoci unpack\" or \"umoci raw unpack\" is used."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-06T15:57:49.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/04/06/2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-29136",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when \"umoci unpack\" or \"umoci raw unpack\" is used."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.openwall.com/lists/oss-security/2021/04/06/2",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2021/04/06/2"
            },
            {
              "name": "https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v",
              "refsource": "CONFIRM",
              "url": "https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v"
            },
            {
              "name": "https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57",
              "refsource": "CONFIRM",
              "url": "https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-29136",
    "datePublished": "2021-04-06T15:57:49.000Z",
    "dateReserved": "2021-03-24T00:00:00.000Z",
    "dateUpdated": "2024-08-03T22:02:50.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-29136",
      "date": "2026-09-16",
      "epss": "0.00344",
      "percentile": "0.27773"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:linuxfoundation:umoci:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"0.4.7\", \"matchCriteriaId\": \"DD17F3AC-63F8-41CA-8A85-C880F8704C8D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sylabs:singularity:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.7.3\", \"matchCriteriaId\": \"3F33F771-2B43-432C-9EC5-1639E19D5F72\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when \\\"umoci unpack\\\" or \\\"umoci raw unpack\\\" is used.\"}, {\"lang\": \"es\", \"value\": \"Open Container Initiative umoci versiones anteriores a 0.4.7, permite a atacantes sobrescribir rutas de host arbitrarias por medio de una imagen dise\\u00f1ada que causa un salto de enlace simb\\u00f3lico cuando es usado \\\"umoci unpack\\\" o \\\"umoci raw unpack\\\"\"}]",
      "id": "CVE-2021-29136",
      "lastModified": "2024-11-21T06:00:45.630",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:N/I:P/A:N\", \"baseScore\": 2.1, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2021-04-06T16:15:16.520",
      "references": "[{\"url\": \"http://www.openwall.com/lists/oss-security/2021/04/06/2\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/04/06/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-29136\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2021-04-06T16:15:16.520\",\"lastModified\":\"2024-11-21T06:00:45.630\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when \\\"umoci unpack\\\" or \\\"umoci raw unpack\\\" is used.\"},{\"lang\":\"es\",\"value\":\"Open Container Initiative umoci versiones anteriores a 0.4.7, permite a atacantes sobrescribir rutas de host arbitrarias por medio de una imagen dise\u00f1ada que causa un salto de enlace simb\u00f3lico cuando es usado \\\"umoci unpack\\\" o \\\"umoci raw unpack\\\"\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:N/I:P/A:N\",\"baseScore\":2.1,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:linuxfoundation:umoci:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.4.7\",\"matchCriteriaId\":\"DD17F3AC-63F8-41CA-8A85-C880F8704C8D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sylabs:singularity:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.7.3\",\"matchCriteriaId\":\"3F33F771-2B43-432C-9EC5-1639E19D5F72\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2021/04/06/2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/04/06/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-11-21T16:18:21+00:00",
      "cve": "CVE-2021-29136",
      "id": "CVE-2021-29136",
      "initial_release_date": "2021-04-06T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "singularity: allows overwriting of host files",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-29136.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-31T02:05:39Z",
      "cve": "CVE-2021-29136",
      "id": "CVE-2021-29136",
      "initial_release_date": "2023-02-15T03:43:40Z",
      "product_status:recommended": "66",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-29136",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-29136.json",
      "version": "20"
    }
  }
}

FKIE_CVE-2021-29136

Vulnerability from fkie_nvd - Published: 2021-04-06 16:15 - Updated: 2026-06-17 03:47

Severity

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.

References

URL	Tags
cve@mitre.org	http://www.openwall.com/lists/oss-security/2021/04/06/2	Mailing List, Patch, Third Party Advisory
cve@mitre.org	https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57	Patch, Third Party Advisory
cve@mitre.org	https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2021/04/06/2	Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v	Third Party Advisory

Impacted products

	Vendor	Product	Version
	linuxfoundation	umoci	*
	sylabs	singularity	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxfoundation:umoci:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD17F3AC-63F8-41CA-8A85-C880F8704C8D",
              "versionEndExcluding": "0.4.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sylabs:singularity:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F33F771-2B43-432C-9EC5-1639E19D5F72",
              "versionEndExcluding": "3.7.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when \"umoci unpack\" or \"umoci raw unpack\" is used."
    },
    {
      "lang": "es",
      "value": "Open Container Initiative umoci versiones anteriores a 0.4.7, permite a atacantes sobrescribir rutas de host arbitrarias por medio de una imagen dise\u00f1ada que causa un salto de enlace simb\u00f3lico cuando es usado \"umoci unpack\" o \"umoci raw unpack\""
    }
  ],
  "id": "CVE-2021-29136",
  "lastModified": "2026-06-17T03:47:20.523",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-04-06T16:15:16.520",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2021/04/06/2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2021/04/06/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-9M95-8HX6-7P9V

Vulnerability from github – Published: 2022-02-15 01:17 – Updated: 2022-03-15 21:39

Summary

Improper input validation in umoci

Details

Impact

umoci 0.4.6 and earlier can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." (or "/"). Because umoci deletes inodes if they change types, this results in the rootfs directory being replaced with an attacker-controlled symlink. Subsequent image layers will then be applied on top of the target of the symlink (which could be any directory on the host filesystem the user running umoci has access to).

While umoci does have defences against symlink-based attacks, they are all implemented by resolving things relative to the rootfs directory -- if the rootfs itself is a symlink, umoci resolves it first.

This vulnerability affects both "umoci unpack" and "umoci raw unpack".

Patches

This issue has been patched in umoci 0.4.7, see the references section for the specific commit which fixed this vulnerability.

Workarounds

Note that if you use umoci as an unprivileged user (using the --rootless flag) then umoci will not be able to overwrite any files that your user doesn't have access to. Other possible mitigations are to run umoci under an LSM profile such as AppArmor or SELinux to restrict the level of access it has outside of container image directories.

References

Credits

Thanks to Robin Peraglie from Cure53 for discovering and reporting this vulnerability.

For more information

If you have any questions or comments about this advisory * Open an issue in https://github.com/opencontainers/umoci. * Email us at security@opencontainers.org.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/opencontainers/umoci"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-29136"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-20T20:13:37Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\numoci 0.4.6 and earlier can be tricked into modifying host files by\ncreating a malicious layer that has a symlink with the name \".\" (or\n\"/\"). Because umoci deletes inodes if they change types, this results in\nthe rootfs directory being replaced with an attacker-controlled symlink.\nSubsequent image layers will then be applied on top of the target of the\nsymlink (which could be any directory on the host filesystem the user\nrunning umoci has access to).\n\nWhile umoci does have defences against symlink-based attacks, they are\nall implemented by resolving things relative to the rootfs directory --\nif the rootfs itself is a symlink, umoci resolves it first.\n\nThis vulnerability affects both \"umoci unpack\" and \"umoci raw unpack\".\n\n### Patches\nThis issue has been patched in umoci 0.4.7, see the references section\nfor the specific commit which fixed this vulnerability.\n\n### Workarounds\nNote that if you use umoci as an unprivileged user (using the --rootless\nflag) then umoci will not be able to overwrite any files that your user\ndoesn\u0027t have access to. Other possible mitigations are to run umoci\nunder an LSM profile such as AppArmor or SELinux to restrict the level\nof access it has outside of container image directories.\n\n### References\n* [oss-security public disclosure](https://www.openwall.com/lists/oss-security/2021/04/06/2)\n* [patch](https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57)\n\n### Credits\nThanks to Robin Peraglie from Cure53 for discovering and reporting this\nvulnerability.\n\n### For more information\n\nIf you have any questions or comments about this advisory\n* Open an issue in \u003chttps://github.com/opencontainers/umoci\u003e.\n* Email us at \u003csecurity@opencontainers.org\u003e.",
  "id": "GHSA-9m95-8hx6-7p9v",
  "modified": "2022-03-15T21:39:42Z",
  "published": "2022-02-15T01:17:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29136"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/04/06/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper input validation in umoci"
}

GSD-2021-29136

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.

Aliases

CVE-2021-29136

Aliases

CVE-2021-29136

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-29136",
    "description": "Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when \"umoci unpack\" or \"umoci raw unpack\" is used.",
    "id": "GSD-2021-29136",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-29136.html",
      "https://advisories.mageia.org/CVE-2021-29136.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-29136"
      ],
      "details": "Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when \"umoci unpack\" or \"umoci raw unpack\" is used.",
      "id": "GSD-2021-29136",
      "modified": "2023-12-13T01:23:37.047318Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2021-29136",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when \"umoci unpack\" or \"umoci raw unpack\" is used."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://www.openwall.com/lists/oss-security/2021/04/06/2",
            "refsource": "MISC",
            "url": "http://www.openwall.com/lists/oss-security/2021/04/06/2"
          },
          {
            "name": "https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v",
            "refsource": "CONFIRM",
            "url": "https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v"
          },
          {
            "name": "https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57",
            "refsource": "CONFIRM",
            "url": "https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003cv0.4.7",
          "affected_versions": "All versions before 0.4.7",
          "cvss_v2": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-20",
            "CWE-937"
          ],
          "date": "2022-02-15",
          "description": "The Open Container Initiative\u0027s umoci allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when `umoci unpack` or `umoci raw unpack` is used.",
          "fixed_versions": [
            "v0.4.7"
          ],
          "identifier": "CVE-2021-29136",
          "identifiers": [
            "GHSA-9m95-8hx6-7p9v",
            "CVE-2021-29136"
          ],
          "not_impacted": "All versions starting from 0.4.7",
          "package_slug": "go/github.com/opencontainers/umoci",
          "pubdate": "2022-02-15",
          "solution": "Upgrade to version 0.4.7 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-29136",
            "https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57",
            "http://www.openwall.com/lists/oss-security/2021/04/06/2",
            "https://github.com/advisories/GHSA-9m95-8hx6-7p9v"
          ],
          "uuid": "39a7e565-9b0c-4b20-9f72-56de6c44e6e7",
          "versions": [
            {
              "commit": {
                "sha": "2497bff192f776a131ef1c03331c0846dcf2af1e",
                "tags": [
                  "v0.4.7"
                ],
                "timestamp": "20210405115851"
              },
              "number": "v0.4.7"
            }
          ]
        },
        {
          "affected_range": "\u003cv3.7.3",
          "affected_versions": "All versions before 3.7.3",
          "cvss_v2": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-20",
            "CWE-937"
          ],
          "date": "2021-05-20",
          "description": "Open Container Initiative umoci allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when `umoci unpack` or `umoci raw unpack` is used.",
          "fixed_versions": [
            "v3.7.3"
          ],
          "identifier": "CVE-2021-29136",
          "identifiers": [
            "CVE-2021-29136",
            "GHSA-9m95-8hx6-7p9v"
          ],
          "not_impacted": "All versions starting from 3.7.3",
          "package_slug": "go/github.com/sylabs/singularity/internal/pkg/runtime/engines/singularity",
          "pubdate": "2021-04-06",
          "solution": "Upgrade to version 3.7.3 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-29136"
          ],
          "uuid": "6d1ba255-bafd-4fab-af09-1361683531ff",
          "versions": [
            {
              "commit": {
                "sha": "fb8b5f1d90b30ba0f5c42406ca80390f1f49e45f",
                "tags": [
                  "v3.7.3"
                ],
                "timestamp": "20210406213959"
              },
              "number": "v3.7.3"
            }
          ]
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:linuxfoundation:umoci:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.4.7",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sylabs:singularity:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.7.3",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-29136"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when \"umoci unpack\" or \"umoci raw unpack\" is used."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2021/04/06/2",
              "refsource": "MISC",
              "tags": [
                "Mailing List",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2021/04/06/2"
            },
            {
              "name": "https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2021-05-20T14:32Z",
      "publishedDate": "2021-04-06T16:15Z"
    }
  }
}

OPENSUSE-SU-2021:0548-1

Vulnerability from csaf_opensuse - Published: 2021-04-13 08:23 - Updated: 2021-04-13 08:23

Summary

Security update for umoci

Severity

Important

Scope

1 vulnerability in this advisory, including CVE-2021-29136.

CVE-2021-29136

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Recommended: 1 product

Open the full advisory

OPENSUSE-SU-2021:0810-1

Vulnerability from csaf_opensuse - Published: 2021-05-30 12:05 - Updated: 2021-05-30 12:05

Summary

Security update for singularity

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2021-29136.

CVE-2021-29136

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Recommended: 3 products

Open the full advisory

OPENSUSE-SU-2021:0846-1

Vulnerability from csaf_opensuse - Published: 2021-06-07 05:03 - Updated: 2021-06-07 05:03

Summary

Security update for umoci

Severity

Important

Scope

1 vulnerability in this advisory, including CVE-2021-29136.

CVE-2021-29136

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Recommended: 1 product

Open the full advisory

OPENSUSE-SU-2021:1863-1

Vulnerability from csaf_opensuse - Published: 2021-07-27 14:23 - Updated: 2021-07-27 14:23

Summary

Security update for umoci

Severity

Important

Scope

1 vulnerability in this advisory, including CVE-2021-29136.

CVE-2021-29136

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2024:11384-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

singularity-3.8.3-1.2 on GA media

Severity

Moderate

Scope

12 vulnerabilities in this advisory, including CVE-2021-29136.

CVE-2021-29136

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2024:11482-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

umoci-0.4.7-2.3 on GA media

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2021-29136.

CVE-2021-29136

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Recommended: 4 products

Open the full advisory

SUSE-SU-2021:1116-1

Vulnerability from csaf_suse - Published: 2021-04-09 08:57 - Updated: 2021-04-09 08:57

Summary

Security update for umoci

Severity

Important

Scope

1 vulnerability in this advisory, including CVE-2021-29136.

CVE-2021-29136

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Recommended: 22 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2021-29136 (GCVE-0-2021-29136)

Impact

Patches

Workarounds

References

Credits

For more information

Tags

Sightings

Nomenclature

Related by attack behaviour