CVE-2021-20271: RPM Package Manager RCE Vulnerability

CVE-2021-20271 Overview

A flaw was found in RPM's signature check functionality when reading a package file. This vulnerability allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

Critical Impact

Attackers can bypass RPM signature verification to execute arbitrary code and corrupt the RPM database, compromising system integrity on Linux distributions using RPM package management.

Affected Products

• RPM Package Manager (versions prior to fix, including 4.15.0-alpha/beta/rc1 and 4.16.0-alpha/beta2/beta3/rc1)
• Red Hat Enterprise Linux 8.0
• Fedora 32, 33, and 34
• StarWind Virtual SAN v8 (build 14398)

Discovery Timeline

• 2021-03-26 - CVE-2021-20271 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-20271

Vulnerability Analysis

This vulnerability (CWE-345: Insufficient Verification of Data Authenticity) exists in the way RPM handles signature header data during package installation. When processing an RPM package file, the signature verification mechanism fails to properly validate the integrity of signature header data before copying it into the main package header. An attacker can craft a malicious RPM package that appears to have a valid signature but contains modified signature header data that bypasses verification checks.

The flaw enables code execution because RPM trusts the signature header data without adequate validation, allowing the injection of malicious payloads that execute during package installation. Additionally, the corruption of the RPM database can lead to system instability and potential denial of service conditions.

Root Cause

The root cause lies in insufficient validation when copying data from the signature header to the main header during package processing. RPM was not carefully verifying the count and type of signature tags being translated and merged, allowing malformed or manipulated signature data to be processed as trusted input.

Attack Vector

The attack requires local access and user interaction—specifically, convincing a user to install a malicious RPM package. The attacker crafts a package with a modified signature header that passes initial verification checks but contains malicious data. When the victim installs the package using standard RPM tools, the corrupted signature data is processed, leading to database corruption and potential code execution.

The following patch from the RPM project demonstrates how the fix addresses this vulnerability by implementing stricter validation of signature header data:

    rpmRC rc;
};

+struct taglate_s {
+    rpmTagVal stag;
+    rpmTagVal xtag;
+    rpm_count_t count;
+} const xlateTags[] = {
+    { RPMSIGTAG_SIZE, RPMTAG_SIGSIZE, 1 },
+    { RPMSIGTAG_PGP, RPMTAG_SIGPGP, 0 },
+    { RPMSIGTAG_MD5, RPMTAG_SIGMD5, 16 },
+    { RPMSIGTAG_GPG, RPMTAG_SIGGPG, 0 },
+    /* { RPMSIGTAG_PGP5, RPMTAG_SIGPGP5, 0 }, */ /* long obsolete, dont use */
+    { RPMSIGTAG_PAYLOADSIZE, RPMTAG_ARCHIVESIZE, 1 },
+    { RPMSIGTAG_FILESIGNATURES, RPMTAG_FILESIGNATURES, 0 },
+    { RPMSIGTAG_FILESIGNATURELENGTH, RPMTAG_FILESIGNATURELENGTH, 1 },
+    { RPMSIGTAG_VERITYSIGNATURES, RPMTAG_VERITYSIGNATURES, 0 },
+    { RPMSIGTAG_VERITYSIGNATUREALGO, RPMTAG_VERITYSIGNATUREALGO, 1 },
+    { RPMSIGTAG_SHA1, RPMTAG_SHA1HEADER, 1 },
+    { RPMSIGTAG_SHA256, RPMTAG_SHA256HEADER, 1 },
+    { RPMSIGTAG_DSA, RPMTAG_DSAHEADER, 0 },
+    { RPMSIGTAG_RSA, RPMTAG_RSAHEADER, 0 },
+    { RPMSIGTAG_LONGSIZE, RPMTAG_LONGSIGSIZE, 1 },
+    { RPMSIGTAG_LONGARCHIVESIZE, RPMTAG_LONGARCHIVESIZE, 1 },
+    { 0 }
+};
+
/** \ingroup header
 * Translate and merge legacy signature tags into header.
 * @param h		header (dest)

Source: GitHub RPM Commit d6a86b5e69e46cc283b1e06c92343319beb42e21

The fix introduces a taglate_s structure that explicitly defines the expected tag mappings and counts for signature data, ensuring strict validation during the translation and merge process.

Detection Methods for CVE-2021-20271

Indicators of Compromise

• Unexpected RPM database corruption or integrity errors during package operations
• Suspicious RPM packages from untrusted or non-official sources being installed on systems
• Package installation failures followed by unexpected system behavior or unauthorized processes
• Modified or corrupted files in /var/lib/rpm/ database directory

Detection Strategies

• Monitor RPM installation activities for packages sourced from non-standard repositories
• Implement file integrity monitoring on the RPM database (/var/lib/rpm/)
• Use SentinelOne's behavioral AI to detect anomalous process execution following package installations
• Audit system logs for RPM signature verification warnings or errors

Monitoring Recommendations

• Enable detailed logging for all RPM package management operations
• Deploy endpoint detection and response (EDR) solutions to monitor for post-exploitation activities
• Implement network segmentation to limit exposure of systems with vulnerable RPM versions
• Regularly audit installed packages against known-good baseline configurations

How to Mitigate CVE-2021-20271

Immediate Actions Required

• Update RPM to the latest patched version available for your distribution
• Only install packages from trusted, official repositories with valid signatures
• Verify RPM database integrity using rpm --rebuilddb after applying patches
• Review recent package installations for any packages from untrusted sources

Patch Information

Security patches are available from multiple vendors. Apply the appropriate updates for your distribution:

• Red Hat Enterprise Linux: Refer to the Red Hat Bug Report for official patches
• Fedora: Updates available via standard Fedora package repositories (see Fedora Package Announcements)
• Gentoo: Apply GLSA 202107-43
• StarWind Virtual SAN: Review the StarWind Security Advisory

The core fix is available in commit d6a86b5e69e46cc283b1e06c92343319beb42e21 in the RPM GitHub repository.

Workarounds

• Restrict RPM package installation to trusted sources only and enforce GPG signature verification
• Implement strict access controls to prevent unprivileged users from installing packages
• Use package management tools that perform additional integrity verification before installation
• Consider deploying application whitelisting to prevent execution of unauthorized binaries

# Verify GPG signature enforcement is enabled
grep -E "^gpgcheck" /etc/yum.conf /etc/dnf/dnf.conf

# Ensure GPG check is enabled (should output gpgcheck=1)
# If not, add or modify the following in /etc/yum.conf or /etc/dnf/dnf.conf:
# gpgcheck=1
# repo_gpgcheck=1

# Rebuild RPM database after patching
rpm --rebuilddb

# Verify RPM database integrity
rpm -Va --nofiles --nodigest