CVE-2021-3445 – This vulnerability in libdnf allows attackers t... (How to Fix)

Q: What is the severity of CVE-2021-3445?

CVE-2021-3445 has a CVSS score of 7.5 (HIGH). This vulnerability in libdnf allows attackers to execute arbitrary code by modifying RPM package headers and tricking users into installing them. It affects systems using libdnf before version 0.60.1 for package management, primarily impacting Linux distributions like Fedora, RHEL, and CentOS.

📋 TL;DR

This vulnerability in libdnf allows attackers to execute arbitrary code by modifying RPM package headers and tricking users into installing them. It affects systems using libdnf before version 0.60.1 for package management, primarily impacting Linux distributions like Fedora, RHEL, and CentOS.

💻 Affected Systems

Products:

libdnf
DNF package manager
YUM (when using libdnf backend)

Versions: All versions before 0.60.1

Operating Systems: Fedora, RHEL, CentOS, Other Linux distributions using libdnf

Default Config Vulnerable: ⚠️ Yes

Notes: Affects any system using vulnerable libdnf versions for package installation/updates.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with root privileges, allowing data theft, persistence installation, and complete system control.

🟠

Likely Case

Package repository compromise leading to malicious package installation and limited code execution.

🟢

If Mitigated

No impact if packages are only installed from trusted, verified repositories with proper signature validation.

🌐 Internet-Facing: MEDIUM - Requires user interaction to install malicious packages, but could be combined with social engineering.

🏢 Internal Only: MEDIUM - Internal users could be tricked into installing malicious packages from compromised internal repositories.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to modify RPM package headers and social engineering to get user to install package.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: libdnf 0.60.1 and later

Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1932079

Restart Required: No

Instructions:

1. Update libdnf to version 0.60.1 or later using your distribution's package manager. 2. For Fedora/RHEL/CentOS: 'sudo dnf update libdnf'. 3. Verify the update completed successfully.

🔧 Temporary Workarounds

Use only trusted repositories

linux

Configure package manager to only use verified, trusted repositories and disable third-party/unverified repos.

# Check current repos: dnf repolist
# Disable suspicious repos: dnf config-manager --disable <repo-id>

Verify package signatures manually

linux

Manually verify RPM package signatures before installation using rpm command.

# Verify package signature: rpm --checksig package.rpm
# Check specific signature: rpm -Kv package.rpm

🧯 If You Can't Patch

Restrict package installation to administrators only and implement approval workflows
Implement network segmentation to isolate systems from untrusted package repositories

🔍 How to Verify

Check if Vulnerable:

Check libdnf version with: rpm -q libdnf --queryformat '%{VERSION}\n'

Check Version:

rpm -q libdnf

Verify Fix Applied:

Verify libdnf version is 0.60.1 or higher: rpm -q libdnf | grep -E '0\.6[0-9]\.[0-9]+|0\.([7-9]|[1-9][0-9]+)\.[0-9]+'

📡 Detection & Monitoring

Log Indicators:

Failed package signature verification in dnf/yum logs
Package installations from unusual repositories
Unexpected package installation events

Network Indicators:

Connections to untrusted package repositories
Downloads of RPM packages from unusual sources

SIEM Query:

source="dnf.log" AND ("signature verification failed" OR "package from untrusted repo")

📊 Metadata

CVE ID: CVE-2021-3445

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-347

Published: May 19, 2021

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-3445, you might also want to check these: