CVE-2021-32760: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd
Summary
CVE-2021-32760: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd. Affects github.com/containerd/containerd across 2 version ranges.
< 1.4.8
>= 1.5.0, < 1.5.4
Fixed in 1.4.8 or 1.5.4, depending on the release line you run. How to fix ↓
Also tracked for
- containerd · Debian:11
The same CVE-2021-32760 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/containerd/containerd, which is written in Go. Containerd is an open-source container runtime that provides a reliable and high-performance runtime environment for containers. It is widely used in various container orchestration platforms and cloud-native ecosystems. However, a vulnerability has been discovered in the Archive package of containerd, which allows the chmod operation to be performed on a file outside of the intended unpack target directory.
Vulnerability Detail
The vulnerability (CVE-2021-32760) arises from a flaw in the Archive package of containerd. It enables an attacker to manipulate the permissions of a file outside of the designated unpack target directory. By exploiting this vulnerability, an attacker could potentially gain unauthorized access to sensitive files or execute arbitrary code on the host system. This vulnerability poses a significant risk to the security and integrity of containerized applications and the underlying infrastructure.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.4.81.4.8go get github.com/containerd/containerd@v1.4.8 -
>= 1.5.0, < 1.5.41.5.4go get github.com/containerd/containerd@v1.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can exercise caution when handling container images and ensure that only trusted images are used. Additionally, it is advisable to restrict the permissions of the container runtime and implement strict access controls to minimize the impact of a potential exploit. Here is an example of how to restrict the permissions using AppArmor in a Docker environment:
# Add the following lines to the Docker daemon configuration file (e.g., /etc/docker/daemon.json):
{
"security-opt": ["apparmor:docker-default"],
"apparmor_profile": "docker-default"
}
# Reload the Docker daemon:
$ systemctl reload docker
This workaround helps mitigate the risk until the package is updated to a fixed version.
Conclusion
The Archive package in github.com/containerd/containerd is vulnerable to a flaw that allows unauthorized chmod operations on files outside of the intended unpack target directory. This can lead to unauthorized access to sensitive files or the execution of arbitrary code. To mitigate this risk, it is crucial to update the containerd package to the fixed versions mentioned above. Additionally, implementing strict access controls and exercising caution when handling container images can provide temporary mitigation until the package is updated.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
The vulnerability allows an attacker to manipulate file permissions outside of the intended unpack target directory. This can lead to unauthorized access to sensitive files or the execution of arbitrary code on the host system, posing a significant security risk.
Versions 0.x and 1.5.0 to 1.5.3 of containerd are affected by this vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended fixes promptly to mitigate the risk.
No, this vulnerability requires local access to the container runtime environment. However, it is still critical to address the vulnerability to prevent potential privilege escalation or lateral movement within the infrastructure.
As of now, there is no publicly available CVSS score for this vulnerability. It is advisable to stay updated with the latest security advisories and vulnerability databases for any future assessments.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
