CVE catalog

CVE-2021-32760

containerd: CVE-2021-32760

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.59% · Oct 25, 2026

containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancontainerdsid2.1.9+ds1-5fixed
Debiancontainerdforky2.1.9+ds1-5fixed
Debiancontainerdtrixie1.7.24~ds1-6+deb13u1fixed
Debiancontainerdtrixie-security1.7.24~ds1-6+deb13u1fixed
Debiancontainerdbookworm1.6.20~ds1-1+deb12u3fixed
Debiancontainerdbookworm-security1.6.20~ds1-1+deb12u2fixed
Ubuntucontainerdpro0.2.1-0ubuntu4~16.04vulnerable
Ubuntucontainerdpro0.2.3-0ubuntu1~16.04vulnerable
Ubuntucontainerdpro0.2.5-0ubuntu1~16.04.1vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.2vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.3vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.4vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.5vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm1vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm2fixed
Ubuntucontainerd18.040.2.5-0ubuntu2vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.3vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.4vulnerable
Ubuntucontainerd18.041.4.4-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.2fixed
Ubuntucontainerd20.041.2.10-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.2-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.3vulnerable
Ubuntucontainerd20.041.4.4-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.2fixed
Opensusecontainerdleap 15.21.4.4-lp152.2.9.1fixed
Susecontainerdlinux enterprise module for containers 15 sp21.4.4-5.36.1fixed
Susecontainerdlinux enterprise module for containers 15 sp31.4.4-5.36.1fixed
Susecontainerdlinux enterprise micro 5.01.4.4-5.36.1fixed
Susecontainerdlinux enterprise module for containers 121.4.4-16.42.1fixed
Ubuntucontainerdpro0.2.1-0ubuntu4~16.04vulnerable
Ubuntucontainerdpro0.2.3-0ubuntu1~16.04vulnerable
Ubuntucontainerdpro0.2.5-0ubuntu1~16.04.1vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.2vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.3vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.4vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.5vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm1vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm2fixed
Ubuntucontainerd18.040.2.5-0ubuntu2vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.3vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.4vulnerable
Ubuntucontainerd18.041.4.4-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.2fixed
Ubuntucontainerd20.041.2.10-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.2-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.3vulnerable
Ubuntucontainerd20.041.4.4-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.2fixed
Opensusetrivytumbleweed0.20.2-1.1fixed
Opensusecontainerdleap 15.31.4.4-5.36.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancontainerdsourcesid1.4.5~ds1-2not yet assignedNot reportedNot reported
Debiancontainerdsourceforky1.4.5~ds1-2not yet assignedNot reportedNot reported
Debiancontainerdsourcetrixie1.4.5~ds1-2not yet assignedNot reportedNot reported
Debiancontainerdsourcebookworm1.4.5~ds1-2not yet assignedNot reportedNot reported
Ubuntucontainerddebpro1.2.6-0ubuntu1~16.04.6+esm2Not reportedUSN-5521-1Not reported
Ubuntucontainerddeb18.041.5.2-0ubuntu1~18.04.2Not reportedUSN-5012-1Not reported
Ubuntucontainerddeb20.041.5.2-0ubuntu1~20.04.2Not reportedUSN-5012-1Not reported
Opensusecontainerdrpmleap 15.21.4.4-lp152.2.9.1Not reportedOPENSUSE-SU-2021:1081-1Not reported
Susecontainerdrpmlinux enterprise module for containers 15 sp21.4.4-5.36.1Not reportedSUSE-SU-2021:2412-1Not reported
Susecontainerdrpmlinux enterprise module for containers 15 sp31.4.4-5.36.1Not reportedSUSE-SU-2021:2412-1Not reported
Susecontainerdrpmlinux enterprise micro 5.01.4.4-5.36.1Not reportedSUSE-SU-2021:2412-1Not reported
Susecontainerdrpmlinux enterprise module for containers 121.4.4-16.42.1Not reportedSUSE-SU-2021:2413-1Not reported
Ubuntucontainerddebpro1.2.6-0ubuntu1~16.04.6+esm2Not reportedUBUNTU-CVE-2021-32760Not reported
Ubuntucontainerddeb18.041.5.2-0ubuntu1~18.04.2Not reportedUBUNTU-CVE-2021-32760Not reported
Ubuntucontainerddeb20.041.5.2-0ubuntu1~20.04.2Not reportedUBUNTU-CVE-2021-32760Not reported
Opensusetrivyrpmtumbleweed0.20.2-1.1Not reportedOPENSUSE-SU-2024:11619-1Not reported
Opensusecontainerdrpmleap 15.31.4.4-5.36.1Not reportedOPENSUSE-SU-2021:2412-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [containerd]Unknown
    Details (4)

    • 1.6.20~ds1-1+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

  • [golang-github-containerd-containerd-dev]Unknown

    Source package: [containerd]

    Details (4)

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

[Debian 13 (Trixie)]

  • [containerd]Unknown
    Details (4)

    • 1.7.24~ds1-6+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · 13

  • [golang-github-containerd-containerd-dev]Unknown

    Source package: [containerd]

    Details (4)

    • 1.7.24~ds1-6+deb13u1 · all · trixie

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · all · trixie

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · all · trixie-security

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · all · trixie-security

      Fixed · Fixed: 1.4.5~ds1-2

      dsa · containerd · debian · 13

[openSUSE Tumbleweed]

  • [trivy]Unknown

    Source package: [trivy]

    Details (1)

    • 0.74.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 0.20.2-1.1

      dsa · trivy · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]