Containerd Insufficient Permissions Vulnerability - CVE-2021-41103
Summary
CVE-2021-41103: containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. Affects containerd across 2 version ranges.
< 1.4.5~ds1-2+deb11u1
< 5b46e404f6b9f661a205e28d59c982d3634148f8
Fixed in 1.4.5~ds1-2+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Containerd is an open-source container runtime designed for simplicity, robustness, and portability. It is widely used in cloud-native environments to manage the lifecycle of containers. The vulnerability in question arises from insufficiently restricted permissions on container root directories and certain plugins, which can lead to unauthorized access by unprivileged Linux users.
Vulnerability Detail
A bug was identified in containerd that allows unprivileged Linux users to traverse directory contents and execute programs due to insufficient permission restrictions. This vulnerability can be exploited when containers contain executable programs with extended permission bits, such as setuid. If the UID of an unprivileged user on the host matches the file owner or group inside a container, the user could potentially discover, read, and modify sensitive files. This could lead to unauthorized access and execution of programs within the container, posing significant security risks.
How To Fix
Minimum fixed version
1.4.5~ds1-2+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade containerdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If users are unable to update immediately, they should limit access to the host system to trusted users only. Additionally, updating directory permissions on container bundles directories can help mitigate the risk. For example, you can change the permissions using:
chmod 700 /path/to/container/bundles
This command restricts access to the specified directory to the owner only.
Conclusion
CVE-2021-41103 is a critical vulnerability in containerd that poses significant security risks due to insufficient permission restrictions. Users are strongly advised to update to the latest versions to protect their systems. In the meantime, implementing workarounds can help mitigate potential threats.
See every vulnerability recorded for containerd →
FAQ
CVE-2021-41103 is a vulnerability in containerd that allows unprivileged Linux users to access and execute programs within containers due to insufficient permission restrictions.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your manifest file.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files and execution of programs within containers, potentially compromising the security of the host system.
The safe versions to use are containerd 1.4.11 and 1.5.7. Users should upgrade to these versions to mitigate the vulnerability.
If immediate updates are not possible, limit access to the host to trusted users and update directory permissions on container bundles to reduce the risk.
Related vulnerabilities
Recent vulnerabilities recorded for containerd.
