title: Load malicious images may cause process to be hijacked
description:
When the isula load command is used to load malicious images, attackers can execute arbitrary code.
problem types: CWE-665 Improper Initialization
affected:
{
collectionURL: https://gitee.com/src-openeuler
defaultStatus: unaffected
modules: image
packageName: iSulad
platforms: Linux
product: iSulad
programFiles: https://gitee.com/openeuler/iSulad/blob/master/src/utils/tar/util_archive.c
repo: https://gitee.com/src-openeuler/iSulad
vendor: openEuler
versions:
changes: [at: 0102-fix-loading-of-nsswitch-based-config-inside-chr.patch, status: unaffected], lessThanOrEqual: 2.0.8-20210518.144540.git5288ed93,2.0.18-10,2.1.2, status: affected, version: 0, versionType: patch
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL