UBUNTU-CVE-2021-32760

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2021-32760
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-32760.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-32760
Related
Published
2021-07-19T19:00:00Z
Modified
2021-07-19T19:00:00Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.

References

Affected packages

Ubuntu:Pro:16.04:LTS / containerd

Package

Name
containerd
Purl
pkg:deb/ubuntu/containerd@1.2.6-0ubuntu1~16.04.6+esm2?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.6-0ubuntu1~16.04.6+esm2

Affected versions

0.*

0.2.1-0ubuntu4~16.04
0.2.3-0ubuntu1~16.04
0.2.5-0ubuntu1~16.04.1

1.*

1.2.6-0ubuntu1~16.04.2
1.2.6-0ubuntu1~16.04.3
1.2.6-0ubuntu1~16.04.4
1.2.6-0ubuntu1~16.04.5
1.2.6-0ubuntu1~16.04.6
1.2.6-0ubuntu1~16.04.6+esm1

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "golang-github-docker-containerd-dev": "1.2.6-0ubuntu1~16.04.6+esm2",
            "containerd": "1.2.6-0ubuntu1~16.04.6+esm2"
        }
    ]
}

Ubuntu:18.04:LTS / containerd

Package

Name
containerd
Purl
pkg:deb/ubuntu/containerd@1.5.2-0ubuntu1~18.04.2?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.2-0ubuntu1~18.04.2

Affected versions

0.*

0.2.5-0ubuntu2

1.*

1.2.6-0ubuntu1~18.04.1
1.2.6-0ubuntu1~18.04.2
1.3.3-0ubuntu1~18.04.1
1.3.3-0ubuntu1~18.04.2
1.3.3-0ubuntu1~18.04.3
1.3.3-0ubuntu1~18.04.4
1.4.4-0ubuntu1~18.04.2
1.5.2-0ubuntu1~18.04.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "golang-github-containerd-containerd-dev": "1.5.2-0ubuntu1~18.04.2",
            "golang-github-docker-containerd-dev": "1.5.2-0ubuntu1~18.04.2",
            "containerd": "1.5.2-0ubuntu1~18.04.2",
            "containerd-dbgsym": "1.5.2-0ubuntu1~18.04.2"
        }
    ]
}

Ubuntu:20.04:LTS / containerd

Package

Name
containerd
Purl
pkg:deb/ubuntu/containerd@1.5.2-0ubuntu1~20.04.2?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.2-0ubuntu1~20.04.2

Affected versions

1.*

1.2.10-0ubuntu1
1.3.2-0ubuntu1
1.3.3-0ubuntu1
1.3.3-0ubuntu2
1.3.3-0ubuntu2.1
1.3.3-0ubuntu2.2
1.3.3-0ubuntu2.3
1.4.4-0ubuntu1~20.04.2
1.5.2-0ubuntu1~20.04.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "golang-github-containerd-containerd-dev": "1.5.2-0ubuntu1~20.04.2",
            "golang-github-docker-containerd-dev": "1.5.2-0ubuntu1~20.04.2",
            "containerd": "1.5.2-0ubuntu1~20.04.2",
            "containerd-dbgsym": "1.5.2-0ubuntu1~20.04.2"
        }
    ]
}