Insufficiently restricted permissions on plugin directories
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Users unable to update should limit access to the host to trusted users. Update directory permission on container bundles directories.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | containerd | before 1.4.11; 1.5.0 to before 1.5.7 | 1.4.11, 1.5.7 | Patch available | CNA |
| — | github.com/containerd/containerd (Go) | before 1.4.11 | 1.4.11 | Patch available | GHSA-c2h3-6mxw-7mvq |
| — | github.com/containerd/containerd (Go) | 1.5.0 to before 1.5.7 | 1.5.7 | Patch available | GHSA-c2h3-6mxw-7mvq |
- containerd Vendorbackstage Affected before 1.4.11; 1.5.0 to before 1.5.7 Fixed in 1.4.11, 1.5.7 Patch available CNA
- github.com/containerd/containerd (Go) Vendor— Affected before 1.4.11 Fixed in 1.4.11 Patch available GHSA-c2h3-6mxw-7mvq
- github.com/containerd/containerd (Go) Vendor— Affected 1.5.0 to before 1.5.7 Fixed in 1.5.7 Patch available GHSA-c2h3-6mxw-7mvq
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* | before 1.4.11; 1.5.0 to before 1.5.7 | Vulnerable | backstage |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* Versions before 1.4.11; 1.5.0 to before 1.5.7 Vulnerable ·backstage
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · CNA containerd (containerd) Fixed in 1.4.11, 1.5.7
- Fix · GHSA-c2h3-6mxw-7mvq github.com/containerd/containerd (Go) Fixed in 1.4.11 Advisory →
- Fix · GHSA-c2h3-6mxw-7mvq github.com/containerd/containerd (Go) Fixed in 1.5.7 Advisory →
Red Hat 2 advisories
- RHSA-2022:6517 Released 2022-09-14 · Red Hat rating ImportantRelease of containers for OSP 16.2.z director operator tech preview
- Red Hat OpenStack Platform 16.2 rhosp-rhel8-tech-preview/osp-director-operator, rhosp-rhel8-tech-preview/osp-director-operator-bundle
- RHSA-2022:5673 Released 2022-07-20 · Red Hat rating ImportantRelease of containers for OSP 16.2.z director operator tech preview
- Red Hat OpenStack Platform 16.2 rhosp-rhel8-tech-preview/osp-director-downloader, rhosp-rhel8-tech-preview/osp-director-operator
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2022:5673, RHSA-2022:6517 |
Not affected: 2 products
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenStack Platform 16.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41103
- 2026-10-03 Alias added: GHSA-c2h3-6mxw-7mvq
References
Advisory 6
Other 8
- https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
- https://github.com/containerd/containerd
- https://github.com/containerd/containerd/releases/tag/v1.4.11
- https://github.com/containerd/containerd/releases/tag/v1.5.7
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB
- https://lists.fedoraproject.org/archives/list/[email protected]/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB
More backstage Containerd vulnerabilities
- TI-2021-19622 Improper Preservation of Permissions in containerd CVSS 3.1CRITICAL 9.1
- TI-2023-10635 containerd supplementary groups are not set up properly CVSS 3.1HIGH 7.8
- TI-2022-07700 Insecure handling of image volumes in containerd CRI plugin CVSS 3.1HIGH 7.5
- TI-2026-38567 Improper input validation in backstage containerd CVSS 4.0CRITICAL 9.4
- TI-2026-38569 containerd CRI checkpoint restore CDI annotation smuggling CVSS 4.0HIGH 8.4
- TI-2025-29820 Containerd vulnerable to host filesystem access during image unpack CVSS 4.0HIGH 7.6
Sources
- CVE-2021-41103 · CVE Program
- CVE-2021-41103 · NVD
- FIRST EPSS
- GHSA-c2h3-6mxw-7mvq · GitHub Advisory Database · CC BY 4.0
- CVE-2021-41103 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences