Containerd File Permission Vulnerability: CVE-2021-32760
Summary
CVE-2021-32760: containerd is a container runtime. Affects containerd across 3 version ranges.
< 1.4.5~ds1-2
< 7eba5930496d9bbe375fdf71603e610ad737d2b2
< 69107e47a62e1d690afa2b9b1d43f8ece3ff4483
Fixed in 1.4.5~ds1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Containerd is a widely used container runtime that manages the complete lifecycle of containers, including image transfer, storage, and execution. It is designed to be lightweight and efficient, making it a popular choice for container orchestration platforms. However, certain versions of containerd prior to 1.4.8 and 1.5.4 are susceptible to a vulnerability that can lead to unintended changes in file permissions on the host filesystem.
Vulnerability Detail
The vulnerability identified as CVE-2021-32760 arises from a flaw in containerd that allows a specially-crafted container image to alter Unix file permissions of existing files on the host system. This can result in access denial for the intended file owner, unintended access for others, or the setting of extended permission bits such as setuid, setgid, and sticky. While this bug does not directly enable unauthorized reading, modification, or execution of files, it poses significant security risks by potentially compromising file access controls.
How To Fix
Minimum fixed version
1.4.5~ds1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade containerdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to only pull container images from trusted sources. Additionally, implementing Linux security modules (LSMs) like SELinux or AppArmor can help mitigate the risks by enforcing policies that restrict containerd's access to sensitive files.
Conclusion
CVE-2021-32760 represents a significant security risk for users of containerd versions prior to 1.4.8 and 1.5.4. It is crucial to upgrade to a secure version to protect against unauthorized file permission changes. Implementing workarounds and monitoring tools like Vulert can further enhance security.
See every vulnerability recorded for containerd →
FAQ
CVE-2021-32760 is a vulnerability in containerd that allows unauthorized changes to file permissions on the host filesystem when pulling certain container images.
Containerd versions prior to 1.4.8 and 1.5.4 are affected by this vulnerability.
The vulnerability can lead to unauthorized access to files, denial of access for legitimate users, and potential security breaches due to altered file permissions.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If an immediate upgrade is not possible, ensure that you only pull images from trusted sources and consider using LSMs like SELinux or AppArmor to limit the impact of the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for containerd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
