CVE-2021-3917: 
Rust vulnerability analysis and mitigation

A security vulnerability (CVE-2021-3917) was discovered in the coreos-installer component, where it writes the Ignition config to the target system with world-readable access permissions. The vulnerability was identified in 2021 and affects the CoreOS installer component used in Red Hat OpenShift Container Platform (Red Hat CVE, NVD).

The vulnerability stems from insufficient access permissions set on the /boot/ignition and /boot/ignition/config.ign directories. The Ignition config file, which may contain sensitive data including secrets, was being created with world-readable permissions, making it accessible to unprivileged processes and users on the system (GitHub Commit).

This vulnerability allows local attackers to have read access to potentially sensitive data stored in the Ignition configuration files. The highest threat from this vulnerability is to confidentiality, as it could expose secrets and sensitive configuration data to unauthorized users (Rapid7).

The vulnerability was fixed in coreos-installer version 0.10.0 by implementing proper file permissions. The fix includes setting restrictive permissions (0o700) on the /boot/ignition directory and (0o600) on the config.ign file, ensuring that only root has access to these sensitive files (GitHub Commit).