CVE-2021-41103: Insufficiently Restricted Permissions on Plugin Directories in containerd
Summary
CVE-2021-41103: Insufficiently restricted permissions on plugin directories. Affects github.com/containerd/containerd across 2 version ranges.
< 1.4.11
>= 1.5.0, < 1.5.7
Fixed in 1.4.11 or 1.5.7, depending on the release line you run. How to fix ↓
Also tracked for
- containerd · Debian:11
The same CVE-2021-41103 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
containerd is an open-source container runtime that provides a platform-agnostic interface for managing containers. It is written in Go and is widely used in container orchestration systems like Kubernetes. containerd allows users to create, run, and manage containers on a host system. However, a vulnerability has been discovered in containerd that allows unprivileged Linux users to traverse directory contents and execute programs with extended permission bits. This can lead to unauthorized access and modification of files within containers.
Vulnerability Detail
The vulnerability arises from insufficiently restricted permissions on container root directories and some plugins in containerd. When containers include executable programs with extended permission bits, unprivileged Linux users can discover and execute those programs. Additionally, if the UID of an unprivileged Linux user on the host collides with the file owner or group inside a container, the user can discover, read, and modify those files. This can result in unauthorized access to sensitive data and potential privilege escalation.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.4.111.4.11go get github.com/containerd/containerd@v1.4.11 -
>= 1.5.0, < 1.5.71.5.7go get github.com/containerd/containerd@v1.5.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A possible workaround for this vulnerability is to limit access to the host system to trusted users. This can be achieved by implementing proper access controls and user management. Additionally, updating directory permissions on container bundles directories can help mitigate the risk of unauthorized access.
Conclusion
The vulnerability in containerd allows unprivileged Linux users to gain unauthorized access and modify files within containers. To mitigate this risk, it is crucial to update containerd to the patched versions and restart containers. Additionally, limiting access to the host system and updating directory permissions can provide further protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
containerd is an open-source container runtime that provides a platform-agnostic interface for managing containers.
The vulnerability allows unprivileged Linux users to traverse directory contents and execute programs with extended permission bits, potentially leading to unauthorized access and modification of files within containers.
To fix this vulnerability, update containerd to version 1.4.11 or 1.5.7 and restart containers. It is also recommended to update directory permissions on container bundles directories.
A possible workaround is to limit access to the host system to trusted users and update directory permissions on container bundles directories.
For more information, you can open an issue in the containerd GitHub repository or email security@containerd.io.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
