We use cookies to improve your experience on our site.
AVID-2026-R0824
Description
Vulnerability CVE-2021-3702
Details
A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner’s private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.
Reason for inclusion in AVID: CVE-2021-3702 describes a race condition in ansible-runner that can allow an attacker to access or tamper with private_data_dir, impacting integrity and confidentiality. Ansible-runner is a deployment/orchestration tool frequently used in pipelines that build, deploy, and operate AI/ML workloads, making this a relevant software supply-chain vulnerability for general-purpose AI systems. The issue is in a software component used to deploy/run AI systems (not purely hardware/firmware), it represents a security vulnerability with clear exploitation behavior, and the report provides explicit evidence (description and references).
References
- NVD entry
- https://github.com/ansible/ansible-runner/pull/742/commits
- https://bugzilla.redhat.com/show_bug.cgi?id=1977965
- https://access.redhat.com/security/cve/CVE-2021-3702
Affected or Relevant Artifacts
- Developer: n/a
- Deployer: n/a
- Artifact Details:
| Type | Name |
|---|---|
| System | ansible-runner |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CWE
| ID | Description |
|---|---|
| CWE-362 | CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2022-08-23
- Version: 0.3.3
- AVID Entry