Vulnerability Description
containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linuxfoundation | Containerd | < 1.4.8 |
| Fedoraproject | Fedora | 34 |
Related Weaknesses (CWE)
References
- https://github.com/containerd/containerd/releases/tag/v1.4.8Release NotesThird Party Advisory
- https://github.com/containerd/containerd/releases/tag/v1.5.4Release NotesThird Party Advisory
- https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj-rx3wThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202401-31
- https://github.com/containerd/containerd/releases/tag/v1.4.8Release NotesThird Party Advisory
- https://github.com/containerd/containerd/releases/tag/v1.5.4Release NotesThird Party Advisory
- https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj-rx3wThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202401-31
FAQ
What is CVE-2021-32760?
CVE-2021-32760 is a vulnerability with a CVSS score of 5.0 (MEDIUM). containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission c...
How severe is CVE-2021-32760?
CVE-2021-32760 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-32760?
Check the references section above for vendor advisories and patch information. Affected products include: Linuxfoundation Containerd, Fedoraproject Fedora.