CVE-2021-20206: linuxfoundation container_network_interface Improper Input Validation
Vulnerability summary
CVE-2021-20206 is a high (CVSS 7.2) Improper Input Validation vulnerability in linuxfoundation container_network_interface. EPSS estimates a 1.52% chance of exploitation in the next 30 days, higher than 74.6% of scored vulnerabilities.
Not severe (CVSS 7.2, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 9Timeline
- 26-03-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · GoEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · AlpineEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.52%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.52% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Affected systems
Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse47 products
- cni-plugins&distro=SUSE Enterprise Storage 6< 0.8.6-150100.3.11.1
- cni-plugins&distro=SUSE Enterprise Storage 7< 0.8.6-150100.3.11.1
- cni-plugins&distro=SUSE Enterprise Storage 7.1< 0.8.6-150100.3.11.1
- cni-plugins&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 0.8.6-150100.3.11.1
- cni-plugins&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 0.8.6-150100.3.11.1
Opensuse11 products
- cni-plugins&distro=openSUSE Leap 15.3< 0.8.6-150100.3.11.1
- cni-plugins&distro=openSUSE Leap 15.4< 0.8.6-150100.3.11.1
- cni-plugins&distro=openSUSE Leap Micro 5.2< 0.8.6-150100.3.11.1
- cni-plugins&distro=openSUSE Leap Micro 5.3< 0.8.6-150100.3.11.1
- cni-plugins&distro=openSUSE Tumbleweed< 1.1.1-2.1
Alpine1 product
- buildah< 1.19.4-r0
Debian1 product
- golang-github-appc-cni< 0.8.1-1
Github.com/containernetworking1 product
- cni< 0.8.1
Linuxfoundation1 product
- container_network_interface< 0.8.1
Ubuntu1 product
- golang-github-appc-cniAll versions (No fix recorded)
7 vendors · 63 products
References
15 links- bugzilla.redhat.com/show_bug.cgi?id=1919391X Refsource MISCREPORTWEBIssue TrackingThird Party Advisory
- snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINERNETWORKINGCNIPKGINVOKE-1070549X Refsource MISCWEBThird Party Advisory
