CVE-2021-33638

2023-10-2908:15:20

CWE-665

openEuler

web.nvd.nist.gov

cve

2021

33638

isula cp

file escape

container security

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

15.5%

JSON

When the isula cp command is used to copy files from a container to a host machine and the container is controlled by an attacker, the attacker can escape the container.

Affected configurations

Nvd

Node

openeulerisulaMatch2.0.8-20210518.144540

openeulerisulaMatch2.0.18-10

openeulerisulaMatch2.1.2

VendorProductVersionCPE
openeulerisula2.0.8-20210518.144540cpe:2.3:a:openeuler:isula:2.0.8-20210518.144540:*:*:*:*:*:*:*
openeulerisula2.0.18-10cpe:2.3:a:openeuler:isula:2.0.18-10:*:*:*:*:*:*:*
openeulerisula2.1.2cpe:2.3:a:openeuler:isula:2.1.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openeuler	isula	2.0.8-20210518.144540	cpe:2.3:a:openeuler:isula:2.0.8-20210518.144540:::::::*
openeuler	isula	2.0.18-10	cpe:2.3:a:openeuler:isula:2.0.18-10:::::::*
openeuler	isula	2.1.2	cpe:2.3:a:openeuler:isula:2.1.2:::::::*

CNA Affected

[
  {
    "collectionURL": "https://gitee.com/src-openeuler",
    "defaultStatus": "unaffected",
    "modules": [
      "image"
    ],
    "packageName": "iSulad",
    "platforms": [
      "Linux"
    ],
    "product": "iSulad",
    "programFiles": [
      "https://gitee.com/openeuler/iSulad/blob/master/src/utils/tar/util_archive.c"
    ],
    "repo": "https://gitee.com/src-openeuler/iSulad",
    "vendor": "openEuler",
    "versions": [
      {
        "changes": [
          {
            "at": "0102-fix-loading-of-nsswitch-based-config-inside-chr.patch",
            "status": "unaffected"
          },
          {
            "at": "0106-fix-loading-of-nsswitch-based-config-inside-chroot-u.patch",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "2.0.8-20210518.144540.git5288ed93,2.0.18-10,2.1.2",
        "status": "affected",
        "version": "0",
        "versionType": "patch"
      }
    ]
  }
]