Lucene search

K
cveOpenEulerCVE-2021-33636
HistoryOct 29, 2023 - 8:15 a.m.

CVE-2021-33636

2023-10-2908:15:20
CWE-94
CWE-665
openEuler
web.nvd.nist.gov
37
cve-2021-33636
isula
load command
malicious images
arbitrary code

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

28.5%

When the isula load command is used to load malicious images, attackers can execute arbitrary code.

Affected configurations

Nvd
Node
openeulerisulaMatch2.0.8-20210518.144540
OR
openeulerisulaMatch2.0.18-10
OR
openeulerisulaMatch2.1.2
VendorProductVersionCPE
openeulerisula2.0.8-20210518.144540cpe:2.3:a:openeuler:isula:2.0.8-20210518.144540:*:*:*:*:*:*:*
openeulerisula2.0.18-10cpe:2.3:a:openeuler:isula:2.0.18-10:*:*:*:*:*:*:*
openeulerisula2.1.2cpe:2.3:a:openeuler:isula:2.1.2:*:*:*:*:*:*:*

CNA Affected

[
  {
    "collectionURL": "https://gitee.com/src-openeuler",
    "defaultStatus": "unaffected",
    "modules": [
      "image"
    ],
    "packageName": "iSulad",
    "platforms": [
      "Linux"
    ],
    "product": "iSulad",
    "programFiles": [
      "https://gitee.com/openeuler/iSulad/blob/master/src/utils/tar/util_archive.c"
    ],
    "repo": "https://gitee.com/src-openeuler/iSulad",
    "vendor": "openEuler",
    "versions": [
      {
        "changes": [
          {
            "at": "0102-fix-loading-of-nsswitch-based-config-inside-chr.patch",
            "status": "unaffected"
          },
          {
            "at": "0106-fix-loading-of-nsswitch-based-config-inside-chroot-u.patch",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "2.0.8-20210518.144540.git5288ed93,2.0.18-10,2.1.2",
        "status": "affected",
        "version": "0",
        "versionType": "patch"
      }
    ]
  }
]

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

28.5%