TOCTOU Race Condition problem in iSulad
Priority LOW 32CWE-367Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in openEuler iSulad on Linux allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This vulnerability is associated with program files https://gitee.Com/openeuler/iSulad/blob/master/src/cmd/isulad/main.C. This issue affects iSulad: 2.0.18-13, from 2.1.4-1 through 2.1.4-2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00146 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| openEuler | iSulad | 2.0.18-13 | — | No fix listed | CNA |
- iSulad VendoropenEuler Affected 2.0.18-13 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33632
- 2026-10-03 Alias added: GHSA-mrfq-6jmf-4q53
References
Other 7
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1307
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1287
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1290
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1289
- https://gitee.com/src-openeuler/iSulad/pulls/645
- https://gitee.com/src-openeuler/iSulad/pulls/640
- https://gitee.com/src-openeuler/iSulad/pulls/639
More openEuler vulnerabilities
- TI-2024-16407 Remote command execution in A-Tune-Collector CVSS 3.1HIGH 8.1
- TI-2025-22539 The giflib open-source component has a buffer overflow vulnerability CVSS 3.1HIGH 7.3
- TI-2021-13009 Pull malicious images may cause process to be hijacked CVSS 3.1CRITICAL 9.8
- TI-2021-13014 Use after free in openEuler 22.03 LTS CVSS 3.1CRITICAL 9.8
- TI-2024-16404 Command injection in ioprobe of gala-gopher CVSS 3.1HIGH 7.8
- TI-2024-16409 Command injection in aops-zeus CVSS 3.1HIGH 7.2
Sources
- CVE-2021-33632 · CVE Program
- CVE-2021-33632 · NVD
- FIRST EPSS
- GHSA-mrfq-6jmf-4q53 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences