containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.
CVSS Details
- CVSS 3.1 Base Score: 5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade containerd | Aug 22, 2024 | Jul 19, 2021 |
| Amazon Linux Ami 2 | — | Upgrade containerd-stressUpgrade containerd-debuginfoUpgrade containerd | Jul 4, 2022 | Jul 19, 2021 |
| Amazon_linux | — | Upgrade containerd | Jul 22, 2021 | Jul 19, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 19, 2021 |
| Debian | — | Upgrade containerd | Jul 30, 2024 | Jul 19, 2021 |
| Gentoo Linux | — | Upgrade app-containers/containerd. | Feb 1, 2024 | Jul 19, 2021 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-engineUpgrade docker-engine-selinux | Apr 20, 2022 | Jul 19, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine-selinuxUpgrade docker-engine | Jun 17, 2022 | Jul 19, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade docker-engine-selinuxUpgrade docker-engine | Jun 22, 2022 | Jul 19, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade docker-engine-selinuxUpgrade docker-engine | Apr 19, 2022 | Jul 19, 2021 |
| Oracle_linux | — | Upgrade docker-cliUpgrade containerdUpgrade docker-engine | Jul 24, 2021 | Jul 19, 2021 |
| Suse | — | Upgrade docker-kubic-bash-completionUpgrade containerd-ctrUpgrade runcUpgrade docker-zsh-completionUpgrade docker-kubic-zsh-completionUpgrade docker-kubic-fish-completionUpgrade docker-kubicUpgrade docker-fish-completionUpgrade dockerUpgrade docker-kubic-kubeadm-criconfigUpgrade docker-bash-completionUpgrade containerd | Jul 21, 2021 | Jul 19, 2021 |
| Ubuntu | — | Upgrade containerdUpgrade containerd (Ubuntu Pro) | Jul 21, 2021 | Jul 19, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 19, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub