GHSA-3r3g-g73x-g593

### Impact

coreos-installer fails to correctly verify GPG signatures when decompressing gzip-compressed artifacts. This allows bypass of signature verification in cases where coreos-installer decompresses a downloaded OS image, allowing an attacker who can modify the OS image to compromise a newly-installed system.

Default installations from ISO or PXE media in Fedora CoreOS, RHEL CoreOS, and RHEL for Edge are **not** affected, as coreos-installer installs from an OS image shipped as part of the install media.

These flows are affected:

1. Installing with `--image-file`, `--image-url`, or `coreos.inst.image_url`. For example, if a user has a local mirror of installation images, an attacker could replace an image with a gzip-compressed alternative (even if the file extension is `.xz`). The result:

``` $ coreos-installer install --image-url http://localhost:8080/image.xz /dev/loop0 Downloading image from http://localhost:8080/image.xz Downloading signature from http://localhost:8080/image.xz.sig > Read disk 749.9 MiB/749.9 MiB (100%) gpg: Signature made Mon 20 Sep 2021 02:41:50 PM EDT gpg: using RSA key 8C5BA6990BDB26E19F2A1A801161AE6945719A39 gpg: BAD signature from "Fedora (34) <fedora-34-primary@fedoraproject.org>" [ultimate] Install complete. ```

Notice that GPG reports a bad signature, but coreos-installer continues anyway. Automation that relies on coreos-installer's exit status will not notice either.

2. `coreos-installer download --decompress --image-url`:

``` $ coreos-installer download --decompress --image-url http://localhost:8080/image.xz > Read disk 749.9 MiB/749.9 MiB (100%) gpg: Signature made Mon 20 Sep 2021 02:41:50 PM EDT gpg: using RSA key 8C5BA6990BDB26E19F2A1A801161AE6945719A39 gpg: BAD signature from "Fedora (34) <fedora-34-primary@fedoraproject.org>" [ultimate] ./image ```

Again, coreos-installer reports success.

3. Installing with default parameters, when **not** installing from the image built into live ISO or PXE media, if the hosting service is compromised or if an active attacker gains control of the HTTPS response.

4. `coreos-installer download --decompress` if the hosting service is compromised or if an active attacker gains control of the HTTPS response.

### Patches

The vulnerability is [fixed](https://github.com/coreos/coreos-installer/pull/659) in coreos-installer 0.10.1.

### Workarounds

For `coreos-installer download`, do not use the `-d` or `--decompress` options.

For `coreos-installer install`, manually inspect the stderr output. If `BAD signature` appears, do not boot from the target disk. Note, however, that some OS services may have already accessed data on the compromised disk.

### References

For more information, see [PR 655](https://github.com/coreos/coreos-installer/pull/655).

### For more information

If you have any questions or comments about this advisory, [open an issue in coreos-installer](https://github.com/coreos/coreos-installer/issues/new/choose) or email the CoreOS [development mailing list](https://lists.fedoraproject.org/archives/list/coreos@lists.fedoraproject.org/).