CVE-2021-41103

MITRE NVD CVE.ORG Print: PDF PDF

Summary

CVECVE-2021-41103
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2021-10-04 17:15:00 UTC
Updated2024-01-31 13:15:00 UTC
Descriptioncontainerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Users unable to update should limit access to the host to trusted users. Update directory permission on container bundles directories.

Risk And Classification

Problem Types: CWE-22

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Debian Debian Linux 11.0 All All All
Operating System Fedoraproject Fedora 34 All All All
Operating System Fedoraproject Fedora 35 All All All
Application Linuxfoundation Containerd All All All All
Application Linuxfoundation Containerd All All All All

References

ReferenceSourceLinkTags
Insufficiently restricted permissions on container root and plugin directories · Advisory · containerd/containerd · GitHub CONFIRM github.com
[SECURITY] Fedora 34 Update: moby-engine-20.10.9-1.fc34 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
[SECURITY] Fedora 34 Update: moby-engine-20.10.9-1.fc34 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf CONFIRM cert-portal.siemens.com
Debian -- Security Information -- DSA-5002-1 containerd DEBIAN www.debian.org
[SECURITY] Fedora 35 Update: moby-engine-20.10.9-1.fc35 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
[SECURITY] Fedora 35 Update: moby-engine-20.10.9-1.fc35 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
containerd: Multiple Vulnerabilities (GLSA 202401-31) — Gentoo security security.gentoo.org
Merge pull request from GHSA-c2h3-6mxw-7mvq · containerd/containerd@5b46e40 · GitHub MISC github.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 178878 Debian Security Update for containerd (DSA 5002-1)
  • 183606 Debian Security Update for containerd (CVE-2021-41103)
  • 198530 Ubuntu Security Notification for containerd Vulnerability (USN-5100-1)
  • 281996 Fedora Security Update for containerd (FEDORA-2021-df975338d4)
  • 352847 Amazon Linux Security Advisory for containerd: ALAS-2021-1540
  • 353187 Amazon Linux Security Advisory for containerd : ALAS2NITRO-ENCLAVES-2022-016
  • 353192 Amazon Linux Security Advisory for containerd : ALAS2DOCKER-2022-016
  • 356886 Amazon Linux Security Advisory for containerd : ALAS2ECS-2023-027
  • 501829 Alpine Linux Security Update for containerd
  • 504643 Alpine Linux Security Update for containerd
  • 590976 Siemens SCALANCE LPE9403 Third-Party Multiple Vulnerabilities (ICSA-22-167-09) (SSA-222547)
  • 6140150 AWS Bottlerocket Security Update for containerd (GHSA-56jr-hp73-5wv9)
  • 671313 EulerOS Security Update for docker-engine (EulerOS-SA-2022-1239)
  • 671321 EulerOS Security Update for docker-engine (EulerOS-SA-2022-1251)
  • 671845 EulerOS Security Update for docker-engine (EulerOS-SA-2022-1886)
  • 671881 EulerOS Security Update for docker-engine (EulerOS-SA-2022-1926)
  • 710846 Gentoo Linux containerd Multiple Vulnerabilities (GLSA 202401-31)
  • 751272 SUSE Enterprise Linux Security Update for containerd, docker, runc (SUSE-SU-2021:3506-1)
  • 751273 OpenSUSE Security Update for containerd, docker, runc (openSUSE-SU-2021:3506-1)
  • 751303 OpenSUSE Security Update for containerd, docker, runc (openSUSE-SU-2021:1404-1)
  • 751692 OpenSUSE Security Update for containerd, docker (openSUSE-SU-2022:0334-1)
  • 753284 SUSE Enterprise Linux Security Update for containerd, docker (SUSE-SU-2022:0334-1)
  • 900363 Common Base Linux Mariner (CBL-Mariner) Security Update for moby-containerd (6154)
  • 901532 Common Base Linux Mariner (CBL-Mariner) Security Update for moby-containerd (6681-1)
  • 980093 Go (go) Security Update for github.com/containerd/containerd (GHSA-c2h3-6mxw-7mvq)
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report