CVE-2021-32760
Fixed in a distro release EPSS 2%CVSS 5.0
containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.
Products: containerd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/containerd/containerd | 1.4.8 |
| Go | github.com/containerd/containerd | 1.5.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | ctop | 0.7.7-r13 |
| Debian:12 | containerd | 1.4.5~ds1-2 |
| Debian:13 | containerd | 1.4.5~ds1-2 |
| Debian:14 | containerd | 1.4.5~ds1-2 |
| SUSE:Enterprise Storage 6 | containerd | 1.4.11-56.1 |
| SUSE:Enterprise Storage 6 | docker | 20.10.9_ce-156.1 |
| SUSE:Enterprise Storage 6 | runc | 1.0.2-23.1 |
| SUSE:Enterprise Storage 7 | runc | 1.0.2-23.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | containerd | 1.4.11-56.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | docker | 20.10.9_ce-156.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | runc | 1.0.2-23.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | containerd | 1.4.11-56.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | docker | 20.10.9_ce-156.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | runc | 1.0.2-23.1 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | containerd | 1.4.11-56.1 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | docker | 20.10.9_ce-156.1 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | runc | 1.0.2-23.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | containerd | 1.4.11-56.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | docker | 20.10.9_ce-156.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | runc | 1.0.2-23.1 |
| SUSE:Linux Enterprise Micro 5.0 | containerd | 1.4.4-5.36.1 |
| SUSE:Linux Enterprise Micro 5.0 | containerd | 1.4.11-56.1 |
| SUSE:Linux Enterprise Micro 5.0 | docker | 20.10.9_ce-156.1 |
| SUSE:Linux Enterprise Micro 5.0 | runc | 1.0.2-23.1 |
| SUSE:Linux Enterprise Micro 5.1 | containerd | 1.4.11-56.1 |
| SUSE:Linux Enterprise Micro 5.1 | docker | 20.10.9_ce-156.1 |
| SUSE:Linux Enterprise Micro 5.1 | runc | 1.0.2-23.1 |
| SUSE:Linux Enterprise Module for Containers 12 | containerd | 1.4.11-16.45.1 |
| SUSE:Linux Enterprise Module for Containers 12 | containerd | 1.4.4-16.42.1 |
| SUSE:Linux Enterprise Module for Containers 12 | docker | 20.10.9_ce-98.72.1 |
| SUSE:Linux Enterprise Module for Containers 12 | runc | 1.0.2-16.14.1 |
| SUSE:Linux Enterprise Module for Containers 15 SP2 | containerd | 1.4.4-5.36.1 |
| SUSE:Linux Enterprise Module for Containers 15 SP2 | containerd | 1.4.11-56.1 |
| SUSE:Linux Enterprise Module for Containers 15 SP2 | docker | 20.10.9_ce-156.1 |
| SUSE:Linux Enterprise Module for Containers 15 SP2 | runc | 1.0.2-23.1 |
| SUSE:Linux Enterprise Module for Containers 15 SP3 | containerd | 1.4.11-56.1 |
| SUSE:Linux Enterprise Module for Containers 15 SP3 | containerd | 1.4.4-5.36.1 |
| SUSE:Linux Enterprise Module for Containers 15 SP3 | docker | 20.10.9_ce-156.1 |
| SUSE:Linux Enterprise Module for Containers 15 SP3 | runc | 1.0.2-23.1 |
| SUSE:Linux Enterprise Server 15 SP1-BCL | containerd | 1.4.11-56.1 |
| SUSE:Linux Enterprise Server 15 SP1-BCL | docker | 20.10.9_ce-156.1 |
| SUSE:Linux Enterprise Server 15 SP1-BCL | runc | 1.0.2-23.1 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | containerd | 1.4.11-56.1 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | docker | 20.10.9_ce-156.1 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | runc | 1.0.2-23.1 |
| SUSE:Linux Enterprise Server 15-LTSS | containerd | 1.4.11-56.1 |
| SUSE:Linux Enterprise Server 15-LTSS | docker | 20.10.9_ce-156.1 |
| SUSE:Linux Enterprise Server 15-LTSS | runc | 1.0.2-23.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | containerd | 1.4.11-56.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | docker | 20.10.9_ce-156.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | runc | 1.0.2-23.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | containerd | 1.4.11-56.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | docker | 20.10.9_ce-156.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | runc | 1.0.2-23.1 |
| Ubuntu:18.04:LTS | containerd | 1.5.2-0ubuntu1~18.04.2 |
| Ubuntu:20.04:LTS | containerd | 1.5.2-0ubuntu1~20.04.2 |
| Ubuntu:Pro:16.04:LTS | containerd | 1.2.6-0ubuntu1~16.04.6+esm2 |
| Wolfi | ctop | 0.7.7-r13 |
| openSUSE:Leap 15.2 | containerd | 1.4.4-lp152.2.9.1 |
| openSUSE:Leap 15.2 | containerd | 1.4.11-lp152.2.12.1 |
| openSUSE:Leap 15.2 | docker | 20.10.9_ce-lp152.2.18.1 |
| openSUSE:Leap 15.2 | runc | 1.0.2-lp152.2.9.1 |
| openSUSE:Leap 15.3 | containerd | 1.4.11-56.1 |
| openSUSE:Leap 15.3 | containerd | 1.4.4-5.36.1 |
| openSUSE:Leap 15.3 | docker | 20.10.9_ce-156.1 |
| openSUSE:Leap 15.3 | docker-kubic | 20.10.9_ce-156.1 |
| openSUSE:Leap 15.3 | runc | 1.0.2-23.1 |
| openSUSE:Tumbleweed | containerd | 1.4.8-2.2 |
| openSUSE:Tumbleweed | trivy | 0.20.2-1.1 |