CVE catalog

CVE-2021-41103

containerd: CVE-2021-41103

Severity: Medium · CVSS 5.9CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Published: Oct 4, 2021, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.52% · Oct 25, 2026

containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Users unable to update should limit access to the host to trusted users. Update directory permission on container bundles directories.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	containerd	sid	`2.1.9+ds1-5`	fixed
Debian	containerd	forky	`2.1.9+ds1-5`	fixed
Debian	containerd	trixie	`1.7.24~ds1-6+deb13u1`	fixed
Debian	containerd	trixie-security	`1.7.24~ds1-6+deb13u1`	fixed
Debian	containerd	bookworm	`1.6.20~ds1-1+deb12u3`	fixed
Debian	containerd	bookworm-security	`1.6.20~ds1-1+deb12u2`	fixed
Ubuntu	containerd	18.04	`0.2.5-0ubuntu2`	vulnerable
Ubuntu	containerd	18.04	`1.2.6-0ubuntu1~18.04.1`	vulnerable
Ubuntu	containerd	18.04	`1.2.6-0ubuntu1~18.04.2`	vulnerable
Ubuntu	containerd	18.04	`1.3.3-0ubuntu1~18.04.1`	vulnerable
Ubuntu	containerd	18.04	`1.3.3-0ubuntu1~18.04.2`	vulnerable
Ubuntu	containerd	18.04	`1.3.3-0ubuntu1~18.04.3`	vulnerable
Ubuntu	containerd	18.04	`1.3.3-0ubuntu1~18.04.4`	vulnerable
Ubuntu	containerd	18.04	`1.4.4-0ubuntu1~18.04.2`	vulnerable
Ubuntu	containerd	18.04	`1.5.2-0ubuntu1~18.04.1`	vulnerable
Ubuntu	containerd	18.04	`1.5.2-0ubuntu1~18.04.2`	vulnerable
Ubuntu	containerd	18.04	`1.5.2-0ubuntu1~18.04.3`	fixed
Ubuntu	containerd	20.04	`1.2.10-0ubuntu1`	vulnerable
Ubuntu	containerd	20.04	`1.3.2-0ubuntu1`	vulnerable
Ubuntu	containerd	20.04	`1.3.3-0ubuntu1`	vulnerable
Ubuntu	containerd	20.04	`1.3.3-0ubuntu2`	vulnerable
Ubuntu	containerd	20.04	`1.3.3-0ubuntu2.1`	vulnerable
Ubuntu	containerd	20.04	`1.3.3-0ubuntu2.2`	vulnerable
Ubuntu	containerd	20.04	`1.3.3-0ubuntu2.3`	vulnerable
Ubuntu	containerd	20.04	`1.4.4-0ubuntu1~20.04.2`	vulnerable
Ubuntu	containerd	20.04	`1.5.2-0ubuntu1~20.04.1`	vulnerable
Ubuntu	containerd	20.04	`1.5.2-0ubuntu1~20.04.2`	vulnerable
Ubuntu	containerd	20.04	`1.5.2-0ubuntu1~20.04.3`	fixed
Opensuse	containerd	tumbleweed	`1.4.11-1.1`	fixed
Ubuntu	containerd	pro	`0.2.1-0ubuntu4~16.04`	vulnerable
Ubuntu	containerd	pro	`0.2.3-0ubuntu1~16.04`	vulnerable
Ubuntu	containerd	pro	`0.2.5-0ubuntu1~16.04.1`	vulnerable
Ubuntu	containerd	pro	`1.2.6-0ubuntu1~16.04.2`	vulnerable
Ubuntu	containerd	pro	`1.2.6-0ubuntu1~16.04.3`	vulnerable
Ubuntu	containerd	pro	`1.2.6-0ubuntu1~16.04.4`	vulnerable
Ubuntu	containerd	pro	`1.2.6-0ubuntu1~16.04.5`	vulnerable
Ubuntu	containerd	pro	`1.2.6-0ubuntu1~16.04.6`	vulnerable
Ubuntu	containerd	pro	`1.2.6-0ubuntu1~16.04.6+esm1`	vulnerable
Ubuntu	containerd	pro	`1.2.6-0ubuntu1~16.04.6+esm2`	fixed
Ubuntu	containerd	18.04	`0.2.5-0ubuntu2`	vulnerable
Ubuntu	containerd	18.04	`1.2.6-0ubuntu1~18.04.1`	vulnerable
Ubuntu	containerd	18.04	`1.2.6-0ubuntu1~18.04.2`	vulnerable
Ubuntu	containerd	18.04	`1.3.3-0ubuntu1~18.04.1`	vulnerable
Ubuntu	containerd	18.04	`1.3.3-0ubuntu1~18.04.2`	vulnerable
Ubuntu	containerd	18.04	`1.3.3-0ubuntu1~18.04.3`	vulnerable
Ubuntu	containerd	18.04	`1.3.3-0ubuntu1~18.04.4`	vulnerable
Ubuntu	containerd	18.04	`1.4.4-0ubuntu1~18.04.2`	vulnerable
Ubuntu	containerd	18.04	`1.5.2-0ubuntu1~18.04.1`	vulnerable
Ubuntu	containerd	18.04	`1.5.2-0ubuntu1~18.04.2`	vulnerable
Ubuntu	containerd	18.04	`1.5.2-0ubuntu1~18.04.3`	fixed
Ubuntu	containerd	20.04	`1.2.10-0ubuntu1`	vulnerable
Ubuntu	containerd	20.04	`1.3.2-0ubuntu1`	vulnerable
Ubuntu	containerd	20.04	`1.3.3-0ubuntu1`	vulnerable
Ubuntu	containerd	20.04	`1.3.3-0ubuntu2`	vulnerable
Ubuntu	containerd	20.04	`1.3.3-0ubuntu2.1`	vulnerable
Ubuntu	containerd	20.04	`1.3.3-0ubuntu2.2`	vulnerable
Ubuntu	containerd	20.04	`1.3.3-0ubuntu2.3`	vulnerable
Ubuntu	containerd	20.04	`1.4.4-0ubuntu1~20.04.2`	vulnerable
Ubuntu	containerd	20.04	`1.5.2-0ubuntu1~20.04.1`	vulnerable
Ubuntu	containerd	20.04	`1.5.2-0ubuntu1~20.04.2`	vulnerable
Ubuntu	containerd	20.04	`1.5.2-0ubuntu1~20.04.3`	fixed
Ubuntu	containerd	22.04	`1.5.5-0ubuntu3`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	containerd	source	sid	`1.5.7~ds1-1`	not yet assigned	Not reported	Not reported
Debian	containerd	source	forky	`1.5.7~ds1-1`	not yet assigned	Not reported	Not reported
Debian	containerd	source	trixie	`1.5.7~ds1-1`	not yet assigned	Not reported	Not reported
Debian	containerd	source	bookworm	`1.5.7~ds1-1`	not yet assigned	Not reported	Not reported
Ubuntu	containerd	deb	18.04	`1.5.2-0ubuntu1~18.04.3`	Not reported	USN-5100-1	Not reported
Ubuntu	containerd	deb	20.04	`1.5.2-0ubuntu1~20.04.3`	Not reported	USN-5100-1	Not reported
Opensuse	containerd	rpm	tumbleweed	`1.4.11-1.1`	Not reported	OPENSUSE-SU-2024:11565-1	Not reported
Ubuntu	containerd	deb	pro	`1.2.6-0ubuntu1~16.04.6+esm2`	Not reported	UBUNTU-CVE-2021-41103	Not reported
Ubuntu	containerd	deb	18.04	`1.5.2-0ubuntu1~18.04.3`	Not reported	UBUNTU-CVE-2021-41103	Not reported
Ubuntu	containerd	deb	20.04	`1.5.2-0ubuntu1~20.04.3`	Not reported	UBUNTU-CVE-2021-41103	Not reported
Ubuntu	containerd	deb	22.04	`1.5.5-0ubuntu3`	Not reported	UBUNTU-CVE-2021-41103	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[containerd]Unknown
Details (4)
- 1.6.20~ds1-1+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
- 1.6.20~ds1-1+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
- 1.6.20~ds1-1+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
- 1.6.20~ds1-1+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
[golang-github-containerd-containerd-dev]Unknown
Source package: [containerd]
Details (4)
- 1.6.20~ds1-1+deb12u3 · all · bookworm
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
- 1.6.20~ds1-1+deb12u3 · all · bookworm
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
- 1.6.20~ds1-1+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
- 1.6.20~ds1-1+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

[Debian 13 (Trixie)]

[containerd]Unknown
Details (4)
- 1.7.24~ds1-6+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · 13
- 1.7.24~ds1-6+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · 13
- 1.7.24~ds1-6+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · 13
- 1.7.24~ds1-6+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · 13
[golang-github-containerd-containerd-dev]Unknown
Source package: [containerd]
Details (4)
- 1.7.24~ds1-6+deb13u1 · all · trixie
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · 13
- 1.7.24~ds1-6+deb13u1 · all · trixie
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · 13
- 1.7.24~ds1-6+deb13u1 · all · trixie-security
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · 13
- 1.7.24~ds1-6+deb13u1 · all · trixie-security
  Fixed · Fixed: 1.5.7~ds1-1
  dsa · containerd · debian · 13

[openSUSE Tumbleweed]

[containerd]Unknown
Source package: [containerd]
Details (1)
- 1.7.33-1.3 · x86_64 · tumbleweed
  Fixed · Fixed: 1.4.11-1.1
  dsa · containerd · opensuse · tumbleweed
[containerd-ctr]Unknown
Source package: [containerd]
Details (1)
- 1.7.33-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 1.4.11-1.1
  Version impact unknown
  dsa · containerd · opensuse · tumbleweed
[containerd-devel]Unknown
Source package: [containerd]
Details (1)
- 1.7.33-1.3 · noarch · tumbleweed
  Unknown · Fixed: 1.4.11-1.1
  Version impact unknown
  dsa · containerd · opensuse · tumbleweed

Observed: Oct 23, 2026, 6:02:40 PM UTC

References

[CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]