CVE-2021-32760: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd
Summary
CVE-2021-32760: Archive package allows chmod of file outside of unpack target directory. Affects github.com/containerd/containerd across 2 version ranges.
< 1.4.8
>= 1.5.0, < 1.5.4
Fixed in 1.4.8 or 1.5.4, depending on the release line you run. How to fix ↓
Also tracked for
- containerd · Debian:11
The same CVE-2021-32760 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/containerd/containerd is an open-source container runtime that provides a platform-agnostic interface for managing containers. It is written in Go and is widely used in containerization technologies. This package allows users to pull and extract container images. However, a vulnerability has been discovered in the package that can result in unintended file permission changes on the host's filesystem when extracting specially-crafted container images.
Vulnerability Detail
The vulnerability in github.com/containerd/containerd allows an attacker to modify the Unix file permissions of existing files outside of the intended unpack target directory. This can lead to various security issues such as denying access to the file's owner, widening access to unauthorized users, or setting extended permission bits like setuid, setgid, and sticky. It's important to note that this vulnerability does not directly allow unauthorized access, modification, or execution of files without additional cooperation from other processes.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.4.81.4.8go get github.com/containerd/containerd@v1.4.8 -
>= 1.5.0, < 1.5.41.5.4go get github.com/containerd/containerd@v1.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to only pull container images from trusted sources. Additionally, Linux security modules (LSMs) like SELinux and AppArmor can be used to limit the files that containerd can interact with, thereby reducing the potential impact of this vulnerability. By configuring appropriate policies and profiles, unexpected file interactions can be prevented.
Conclusion
The vulnerability in github.com/containerd/containerd can result in unintended file permission changes on the host's filesystem. To mitigate this issue, it is crucial to update the containerd package to version 1.4.8 or 1.5.4. Additionally, following the recommended workarounds and utilizing Linux security modules can further reduce the potential impact. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
The vulnerability allows for unintended file permission changes on the host's filesystem, which can lead to denial of access, unauthorized access, or the setting of extended permission bits.
Update the containerd package to version 1.4.8 or 1.5.4, which contain the necessary patches to address the issue.
No, running containers do not need to be restarted after updating the containerd package.
As a temporary workaround, only pull container images from trusted sources and utilize Linux security modules like SELinux and AppArmor to limit file interactions.
For more information, you can open an issue on the containerd GitHub repository or email security@containerd.io if you believe you've found a security bug.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
