CVE-2021-32760

Aliases:GHSA-c72p-9xmj-rx3wGO-2022-0921
Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 19 Jul 2021, 00:00
Last modified:19 Nov 2024, 14:27

Vulnerability Summary

Overall Risk (default)
medium
27/100
CVSS Score
6.8 MEDIUM
v2.0 (nvd)
EPSS Score
0.07% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 Jul 2021, 00:00
Published
Vulnerability first disclosed
19 Nov 2024, 14:27
Last Modified
Vulnerability information updated

Description

containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
  • v3.1•MEDIUM•Score: 6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
  • v2.0•MEDIUM•Score: 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.07%• Percentile: 22%

Techniques & Countermeasures

  • CWE-732•Incorrect Permission Assignment for Critical Resource

    The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

  • CWE-668•Exposure of Resource to Wrong Sphere

    The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Affected Systems

  • containerd•containerd

    ≤ 1.4.7 | ≥ 1.5.0, ≤ 1.5.3

  • fedoraproject•fedora

    34

  • github.com/containerd•containerd

    < 1.4.8 | ≥ 1.5.0, < 1.5.4

  • linuxfoundation•containerd

    < 1.4.8 | ≥ 1.5.0, < 1.5.4

References (11)