6.3

CVE-2021-21334: environment variable leak

Modified
AliasesMGASA-2021-0248UBUNTU-CVE-2021-21334USN-4881-1
Published 10-03-2021Last modified 03-08-2024

Vulnerability summary

CVE-2021-21334 is a medium (CVSS 6.3) Exposure of Resource to Wrong Sphere vulnerability in containerd. EPSS estimates a 1.95% chance of exploitation in the next 30 days, higher than 80.2% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 6.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.95%
0%100%
Low · -0.08 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 7
OPENSUSE-SU-2021:0878-1OPENSUSE-SU-2021:1954-1OPENSUSE-SU-2024:10693-1SUSE-SU-2021:1458-1SUSE-SU-2021:1954-1CGA-743Q-CCVG-4798

Timeline

  1. 10-03-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.

CVSS metrics

9 scores · 8 sources · 2 versions

EPSS trend

Probability

1.95%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

Decrease -0.08 pp

From 2.03% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Alpine2 products
  • containerd≥ 1.4.0, < 1.4.4-r0
  • k3s< 1.20.5.1-r0
Mageia2 products
  • docker-containerd< 1.4.4-1.mga7
  • docker-containerd< 1.4.4-1.mga8
Chainguard1 product
  • ctop< 0.7.7-r13
Containerd1 product
Debian1 product
  • containerd< 1.4.4~ds1-1
Fedoraproject1 product
Github.com/containerd1 product
  • containerd≥ 1.4.0, < 1.4.4 | < 1.3.10
Linuxfoundation1 product
Ubuntu1 product
  • containerdAll versions (No fix recorded) | < 1.5.2-0ubuntu1~18.04.2 | < 1.3.3-0ubuntu2.3
Wolfi1 product
  • ctop< 0.7.7-r13

10 vendors · 12 products

References

24 links
Show all 24 references