Bug 1181961 – VUL-0: CVE-2021-20206: cni,podman,cni-plugins: Arbitrary path injection via type field in CNI configuration

Bug 1181961 - (CVE-2021-20206) VUL-0: CVE-2021-20206: cni,podman,cni-plugins: Arbitrary path injection via type field in CNI configuration

(CVE-2021-20206)
Summary:	VUL-0: CVE-2021-20206: cni,podman,cni-plugins: Arbitrary path injection via t...

Status:	NEW

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Containers Team
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/277299/
Whiteboard:	CVSSv3.1:SUSE:CVE-2021-20206:7.2:(AV:...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2021-02-08 17:27 UTC by Gianluca Gabrielli
Modified:	2022-08-11 11:42 UTC (History)
CC List:	6 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Gianluca Gabrielli 2021-02-08 17:27:24 UTC

CVE-2021-20206

A flaw was found in libcni. A user may  be able to change the "type:" field in a CNI configuration to an arbitrary path and could execute arbitrary binaries on a host.

Upstream patch:

https://github.com/containernetworking/cni/pull/808

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1919391
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20206

Comment 1 Gianluca Gabrielli 2021-02-08 17:29:10 UTC

Upstream patch: https://github.com/containernetworking/cni/commit/ada67263b12ff0c65f1256e120f6d9f7f0277388.patch

Comment 2 Gianluca Gabrielli 2021-02-08 17:33:32 UTC

An improper limitation of path name vulnerability was found in containernetworking/cni. When specifying the plugin to load in the `type` field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. An attacker can use this to execute other existing binaries other than the cni plugins/types such as `reboot`.