CVE-2021-3917 - Vulnerability Details - OpenCVE

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00106.

Key SSVC decision points have not yet been added.

Vendors	Products
Redhat	Coreos-installer Openshift

Configuration 1 [-]

cpe:2.3:a:redhat:coreos-installer:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat OpenShift Container Platform 4.8
coreos-installer-0:0.9.0-8.rhaos4.8.el8	cpe:/a:redhat:openshift:4.8::el8	RHSA-2021:4829	2021-11-30T00:00:00Z
Red Hat OpenShift Container Platform 4.9
coreos-installer-0:0.10.0-2.rhaos4.9.el8	cpe:/a:redhat:openshift:4.9::el8	RHSA-2021:3758	2021-10-18T00:00:00Z

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2021-3917
https://bugzilla.redhat.com/show_bug.cgi?id=2018478
https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0c
https://github.com/coreos/fedora-coreos-tracker/issues/889
https://nvd.nist.gov/vuln/detail/CVE-2021-3917
https://www.cve.org/CVERecord?id=CVE-2021-3917

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2022-08-23T19:03:22

Updated: 2024-08-03T17:09:09.604Z

Reserved: 2021-11-01T00:00:00

Link: CVE-2021-3917

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-08-23T20:15:08.360

Modified: 2024-11-21T06:22:46.257

Link: CVE-2021-3917

Redhat

Severity : Moderate

Publid Date: 2021-07-07T00:00:00Z

Links: CVE-2021-3917 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "coreos-installer", "vendor": "n/a", "versions": [{"status": "affected", "version": "Fixed in coreos-installer 0.10.0"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-276", "description": "CWE-276 - Incorrect Default Permissions", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-08-23T19:03:22", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/coreos/fedora-coreos-tracker/issues/889"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0c"}, {"tags": ["x_refsource_MISC"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2018478"}, {"tags": ["x_refsource_MISC"], "url": "https://access.redhat.com/security/cve/CVE-2021-3917"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2021-3917", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "coreos-installer", "version": {"version_data": [{"version_value": "Fixed in coreos-installer 0.10.0"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-276 - Incorrect Default Permissions"}]}]}, "references": {"reference_data": [{"name": "https://github.com/coreos/fedora-coreos-tracker/issues/889", "refsource": "MISC", "url": "https://github.com/coreos/fedora-coreos-tracker/issues/889"}, {"name": "https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0c", "refsource": "MISC", "url": "https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0c"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=2018478", "refsource": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2018478"}, {"name": "https://access.redhat.com/security/cve/CVE-2021-3917", "refsource": "MISC", "url": "https://access.redhat.com/security/cve/CVE-2021-3917"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:09:09.604Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/coreos/fedora-coreos-tracker/issues/889"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0c"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2018478"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://access.redhat.com/security/cve/CVE-2021-3917"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2021-3917", "datePublished": "2022-08-23T19:03:22", "dateReserved": "2021-11-01T00:00:00", "dateUpdated": "2024-08-03T17:09:09.604Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:coreos-installer:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5FB7948-D4C7-4806-A707-B1F4FC340F97", "versionEndExcluding": "0.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality."}, {"lang": "es", "value": "Se ha encontrado un fallo en coreos-installer, que escribe la configuraci\u00f3n de Ignition en el sistema de destino con permisos de acceso de lectura general. Este fallo permite a un atacante local tener acceso de lectura a datos potencialmente confidenciales. La mayor amenaza de esta vulnerabilidad es la confidencialidad."}], "id": "CVE-2021-3917", "lastModified": "2024-11-21T06:22:46.257", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-08-23T20:15:08.360", "references": [{"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2021-3917"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2018478"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0c"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/coreos/fedora-coreos-tracker/issues/889"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2021-3917"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2018478"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/coreos/fedora-coreos-tracker/issues/889"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-276"}], "source": "nvd@nist.gov", "type": "Primary"}]}