CVE-2021-40153: 
Rocky Linux vulnerability analysis and mitigation

CVE-2021-40153 is a security vulnerability discovered in Squashfs-Tools 4.5, affecting the squashfs_opendir function in unsquash-1.c. The vulnerability was identified on August 27, 2021. The issue occurs because the filename in the directory entry is not validated for traversal outside of the destination directory during the unsquash process, allowing files to be written to locations outside of the intended destination (NVD, Ubuntu).

The vulnerability has a CVSS v3.1 Base Score of 8.1 (High) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. The issue specifically affects the squashfs_opendir function which stores filenames in directory entries without proper validation. This allows an attacker to create malicious squashfs images containing files with names that include path traversal sequences like '../' (Github Issue, NVD).

When exploited, this vulnerability allows an attacker to write files to arbitrary locations outside the intended destination directory. For example, an attacker could write to sensitive system files like /etc/crontab, potentially leading to code execution. The vulnerability affects both file integrity and availability of the system (Github Issue).

The vulnerability was fixed in Squashfs-Tools 4.5 by adding validation checks for filenames. The fix includes checking for invalid characters and path traversal sequences in filenames. Multiple distributions have released security updates: Debian fixed it in version 1:4.3-12+deb10u1 for oldstable and 1:4.4-2+deb11u1 for stable, Fedora released version 4.5-2.fc34, and Ubuntu provided fixes across multiple versions (Debian Security, Fedora Update).