CVE-2021-20319

Vulnerability

An improper signature verification vulnerability exists in coreos-installer versions prior to 0.10.1 [1][3]. When decompressing a gzip-compressed installation image, the GzDecoder does not read EOF from the underlying source, causing the GpgReader to not check the exit status of GPG [4]. This allows a specially crafted gzip image to bypass GPG signature verification. The issue affects flows using --image-file, --image-url, coreos.inst.image_url, or coreos-installer download --decompress --image-url [3][4]. Default installations from ISO or PXE media are not affected as they use trusted images from the installation media [3][4].

Exploitation

An attacker must have network access to modify or replace the installation image before it is downloaded by the target system [1]. No authentication is required. The attacker replaces a legitimate image with a gzip-compressed alternative (even if the file extension is .xz) [3][4]. The victim fetches the image via --image-url or similar option, and coreos-installer downloads the image, decompresses it, and checks the signature. GPG reports a bad signature, but because coreos-installer does not verify the GPG exit status, the installation proceeds anyway [3][4]. User interaction is required (e.g., running the installer command with the malicious URL).

Impact

Successful exploitation causes installation of unsigned, attacker-controlled content to the target node [1]. The attacker can write arbitrary data to the disk, achieving full access (confidentiality, integrity, availability impact) on the newly installed system [1][3]. The compromise occurs at the OS installation stage, giving the attacker elevated privileges equivalent to root on the installed node [2].

Mitigation

The vulnerability is fixed in coreos-installer version 0.10.1 [2][3]. Users should upgrade to the latest release. Affected flows require manual download or installation from untrusted sources; using live ISO or PXE default install paths avoids the issue [3][4]. No workaround is available if the patched version cannot be deployed. The vulnerability is listed in the RustSec advisory database as RUSTSEC-2022-0103 [2].