CVE-2021-3978

Executive Summary

CVE-2021-3978 is a local privilege escalation vulnerability in Cloudflare's octorpki, a component of the cfrpki (Certificate Framework RPKI) suite used for Resource Public Key Infrastructure (RPKI) validation. The flaw arises from the improper preservation of file permissions when octorpki copies binaries using rsync with the -a flag, which preserves the setuid (suid) bit — combined with a service configuration that runs the daemon as root by default. This misconfiguration allows a malicious TAL (Trust Anchor Locator) file processed by octorpki to potentially result in privilege escalation to root on the host system. The vulnerability requires the attacker to first achieve code execution within the octorpki process via another flaw, making it a chained escalation vector rather than a standalone remote exploit. The CVSS score is 7.5, indicating high severity, though no known public exploits or active in-the-wild campaigns have been reported.

Technical Analysis

The vulnerability resides in the file-copy behavior of octorpki within the github.com/cloudflare/cfrpki/cmd/octorpki package. When the application copies binaries or files using the rsync utility, it employs the -a (archive) flag. The -a flag in rsync enables recursive copying while preserving file attributes — including permissions, ownership, and special bits such as the setuid (suid) bit. The NVD description explicitly references this behavior: using -a "forces rsync to copy binaries with the suid bit set as root."

The critical contextual factor is the service definition provided by the vendor. The default systemd service file (package/octorpki.service) specifies that the service runs as User=root (the description references the service definition at https://github.com/cloudflare/cfrpki *(connection failed — verify manually)*/blob/master/package/octorpki.service *(connection failed — verify manually)*). This means:

1. The octorpki daemon runs with root privileges by default.
2. When it copies binaries via rsync with the -a flag, any suid bit present on the source file is preserved on the destination file.
3. If an attacker can influence which binaries get copied (e.g., by controlling input that determines the source path), a binary with the suid bit set could be installed on the system — allowing any local user to execute it with elevated privileges.

The attack mechanism relies on a two-stage chain:

• Stage 1: The attacker must exploit a separate vulnerability to gain code execution inside the octorpki process (e.g., a parsing flaw in a maliciously crafted TAL file — Trust Anchor Locator files that specify the URLs and locations of RPKI trust anchors).
• Stage 2: Once code execution within the root-privileged process is achieved, the attacker leverages the rsync -a behavior to plant or manipulate a suid-root binary, escalating to persistent local root access.

The NVD description specifically notes: "this could allow for a vector, when combined with another vulnerability that causes octorpki to process a malicious TAL file, for a local privilege escalation." The RSYNC operation itself is not triggered remotely; it is an internal file-management routine that becomes dangerous only under the condition of root execution combined with preserved suid bits.

No additional technical details — such as specific function names, endpoint paths, or code snippets beyond those mentioned — are available in the NVD description. Insufficient technical detail exists to map the exact vulnerable code path.

Exploitation Scenarios

Attack Chain Overview: No public PoC exists, and no exploitation in the wild has been reported. The attack chain below is inferred strictly from the NVD description and the documented vulnerability class (CWE-281 — Improper Preservation of Permissions).

Step 1 — Reconnaissance / Target Identification: An attacker identifies a system running octorpki as part of an RPKI validation infrastructure (typically an ISP, hosting provider, or network operator operating RPKI RTR servers). The target runs the default systemd service configuration, which launches the process under the root account. The attacker also identifies an existing input vector that accepts TAL files — either via a network-facing configuration interface or through local file placement that the daemon processes.

Step 2 — Flaw Trigger: The attacker supplies a crafted TAL file designed to trigger a separate, unspecified parsing vulnerability in octorpki (the NVD description explicitly states the escalation is contingent on "another vulnerability that causes octorpki to process a malicious TAL file"). Successful exploitation of this primary flaw results in code execution within the octorpki process context, which runs as root.

Step 3 — Payload Execution / Escalation: With code execution achieved as root inside the octorpki process, the attacker invokes the file-copy routine that uses rsync with the -a flag. The attacker programs or coerces this routine to copy a binary — either a system binary that carries the suid bit or a binary planted with a suid bit by the attacker — to a destination path accessible to local unprivileged users. Because rsync -a preserves the suid bit, the copied binary remains suid-root upon arrival.

The attacker then executes this suid-root binary from a low-privileged local account, achieving persistent privilege escalation to root beyond the lifetime of the octorpki process.

Step 4 — Post-Exploitation Impact: With persistent root access, the attacker can install backdoors, exfiltrate RPKI provisioning data, manipulate certificate validation results to influence BGP routing decisions, pivot laterally to other systems within the network, or disrupt routing-security infrastructure critical to the operator's operations.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and the explicit preconditions described in the NVD entry.

Impact Assessment

Business Impact: Exploitation of CVE-2021-3978 results in complete compromise of the affected host, with root-level persistence. Since octorpki is part of the RPKI trust chain, a compromised instance could allow an attacker to manipulate RPKI validation results — potentially facilitating BGP route hijacking or mis-origination by issuing "valid" certificates for unauthorized prefixes. This is particularly dangerous for network operators relying on RPKI to secure their routing infrastructure, as the trust foundation itself is undermined.

Affected Systems: Systems running octorpki from the cfrpki suite with the default service configuration (root user). The affected version range is unspecified; operators should assume all versions prior to the vendor fix are vulnerable until confirmed otherwise.

Blast Radius: The immediate blast radius is local — only one host is directly compromised. However, the downstream impact on BGP routing security is network-wide: if the compromised system serves as an RPKI validator for downstream customers or peers, those entities may be served incorrect validation data, potentially leading to route acceptance of hijacked prefixes.

CVSS Rationale (Score: 7.5): The score reflects that exploitation requires local access chained with another vulnerability (high attack complexity), but the impact is total confidentiality, integrity, and availability loss on the affected host. No user interaction is required beyond the initial remote or local exploit that seeds the chain.

Detection Guidance

Sigma Rule

title: Detection of Unusual rsync Suid Copy by octorpki
id: 74111bac-4c00-4a37-b9a1-7a2f67dd2302
status: experimental
description: Detects rsync execution with -a flag copying binaries while preserving suid bits, potentially indicating CVE-2021-3978 exploitation.
author: Valtersit Threat Intel
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/rsync'
        CommandLine|contains|all:
            - '-a'
            - '/bin/'
            - 'suid'
    condition: selection
falsepositives:
    - Legitimate administrative rsync operations preserving suid bits
level: medium
tags:
    - attack.privilege_escalation
    - cve.2021-3978

YARA Rule

rule CVE_2021_3978_octorpki_rsync_suid_copy
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects octorpki service file or commands indicating rsync -a with suid preservation"
        cve = "CVE-2021-3978"
        date = "2024-01-01"
    strings:
        $rsync_cmd = "rsync -a" ascii nocase
        $octorpki_bin = "octorpki" ascii nocase
        $suid_flag = "-o" ascii nocase
        $service_file = "User=root" ascii
    condition:
        (uint16(0) == 0x7f4554 or filesize > 0) and 2 of them
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2021-3978 octorpki rsync suid bit copy attempt"; flow:established; content:"octorpki"; nocase; content:"rsync"; nocase; content:"-a"; distance:0; content:"/bin"; distance:0; reference:cve,2021-3978; classtype:attempted-privilege-escalation; sid:5000421; rev:1;)

Note: This vulnerability is primarily local; network-based detection is unlikely. This rule would only fire on anomaly patterns in managed traffic streams, which is a low-probability path.

Elastic Detection

process where event.type == "start" and process.executable == "/usr/bin/rsync" and process.args == "-a" and (process.args ~= "/bin/*" or process.args ~= "/usr/bin/*")

Splunk SPL Query

index=unix sourcetype=linux_audit
| search (process="rsync" OR process_exec="rsync") 
| search command="* -a *" 
| search command="*bin*"
| stats count by host, user, process_exec, command
| where count > 0 AND (user="root" OR user="octorpki")

Wazuh OSSEC Rule

<group name="rsync,">
    <rule id="100921" level="10">
        <if_sid>5500</if_sid>
        <match>rsync -a</match>
        <regex>\s*bin\s*</regex>
        <description>CVE-2021-3978 - Potential rsync suid preservation copy by octorpki</description>
        <group>privilege_escalation,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — two independent sources (CNA and Debian) confirm a fix exists.

1. Immediate Mitigations:

   • Change the octorpki systemd service configuration (/etc/systemd/system/octorpki.service or /lib/systemd/system/octorpki.service) to run the service under an unprivileged user account (e.g., User=rpki).
   • Remove the -a flag from any rsync invocation inside octorpki configuration if the service uses a configurable copy mode; replace with -rlpt or similar, or use cp --no-preserve=mode semantics.
   • Audit all files copied by octorpki for unexpected suid bits: find / -perm -4000 -type f 2>/dev/null | grep octorpki.

2. Patch/Upgrade Steps:

   • Upgrade github.com/cloudflare/cfrpki to the latest patched release (check vendor advisories and Debian security tracker for the specific fixed version).
   • If upgrading is not immediately possible, apply the relevant fix commit from the cfrpki repository manually (contact vendor for patch availability confirmation).
   • Restart the octorpki service after the change: systemctl restart octorpki.

3. Long-Term Hardening:

   • Run octorpki under a non-root system account with minimum required capabilities (e.g., cap_net_bind_service only if RPKI RTR port binding is required).
   • Restrict which users can place or modify TAL files on the system (use read-only file permissions and directories).
   • Implement mandatory access control (SELinux/AppArmor) to confine octorpki, preventing it from writing to system binary directories even if compromised.
   • Add file integrity monitoring for /usr/bin, /usr/sbin, and other system binary paths.
   • Disable suid bits globally on directories where octorpki can write (noexec/nosuid file system flags).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-3978
2. Vendor Service Definition (root default): https://github.com/cloudflare/cfrpki (connection failed — verify manually)/blob/master/package/octorpki.service (connection failed — verify manually)
3. cfrpki Repository (upstream): https://github.com/cloudflare/cfrpki (connection failed — verify manually)
4. Debian Security Tracker (patch confirmation): https://security-tracker.debian.org/tracker/CVE-2021-3978
5. CISA Known Exploited Vulnerabilities Catalog: Not listed (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

Threat Actor Activity: No known threat actor campaigns have been associated with CVE-2021-3978. The EPSS score (0.00142, 3.9th percentile) indicates a very low probability of active exploitation in the wild — this vulnerability is inherently dependent on a secondary flaw and is primarily of concern to RPKI infrastructure operators with high security postures.