CVE-2021-41072

Name of the Vulnerable Software and Affected Versions Squashfs-Tools version 4.5

Description The issue is related to the squashfs opendir function in the unsquash-2.c component of Squashfs-Tools, which incorrectly handles symbolic links before accessing a file. This allows a remote attacker to compromise data integrity and cause a denial of service. Specifically, a crafted squashfs filesystem containing a symbolic link and subsequent contents with the same filename can cause unsquashfs to create the symbolic link outside the expected directory, and then write through the symbolic link elsewhere in the filesystem.

Recommendations For Squashfs-Tools version 4.5, consider disabling the squashfs opendir function in unsquash-2.c as a temporary workaround to prevent potential exploitation. Restrict access to the unsquashfs process to minimize the risk of symbolic link manipulation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.