Paper/Archive/CVE-2021-33635

CVE-2021-33635

openEuler iSulad — Pull malicious images may cause process to be hijacked

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

39

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 46.5.465 × 209.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

When malicious images are pulled by isula pull, attackers can execute arbitrary code.

Affected

ProductAffectedFixed inSource

iSulad≤ 2.0.8-20210518.144540.git5288ed93,2.0.18-10,2.1.2–CNA

isulad≤ 2.0.8-20210518.144540.git5288ed93,2.0.18-10,2.1.2–CISA-ADP

Scores by source

openEuler (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refopeneuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2023-1686 refgitee.com/src-openeuler/iSulad/pulls/627/files refgitee.com/src-openeuler/iSulad/pulls/600/files