Skip to content
Fencer Vulns
medium 5.5

CVE-2021-3917 json

coreos-installer < 0.10.0 writes world-readable Ignition config to installed system

published 2021-11-08 5 y ago modified 2026-06-17 4 mo ago also GHSA-862g-9h5m-m3qv , EUVD-2021-2318

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits
0
none known

Summary

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.

Patch / fix

  • crates.io coreos-installer 0.10.0
  • redhat coreos-installer 0.10.0
  • jenkins openshift 4.9 2.289.3.1630554997-1.el8
  • openshift openshift 4.9 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7
  • openshift openshift 4.9 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
  • openvswitch2.15 openshift 4.9 2.15.0-28.el8fdp
  • coreos-installer openshift 4.9 0.10.0-2.rhaos4.9.el8
  • openshift-hyperkube openshift 4.9 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7
  • openshift-hyperkube openshift 4.9 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
  • openvswitch2.15-test openshift 4.9 2.15.0-28.el8fdp

red hat advisories RHSA-2021:3758RHSA-2021:4829

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3917 updated cvss 0.0

coreos-installer: restrict access permissions on /boot/ignition{,/config.ign}

  • Red Hat Enterprise Linux 8 coreos-installer, coreos-installer-dracut, coreos-installer-bootinfra
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 4.8 coreos-installer 0.9.0-8.rhaos4.8.el8
    fixed: vendor fix RHSA-2021:4829
  • Red Hat OpenShift Container Platform 4.9 coreos-installer 0.10.0-2.rhaos4.9.el8, coreos-installer-bootinfra 0.10.0-2.rhaos4.9.el8
    fixed: vendor fix RHSA-2021:3758
  • Red Hat OpenShift Container Platform 4.8 jenkins 2.303.3.1637596565-1.el8, cri-o 1.21.4-3.rhaos4.8.git84fa55d.el7, cri-o 1.21.4-3.rhaos4.8.git84fa55d.el8, jenkins-2-plugins 4.8.1637599935-1.el8, coreos-installer-bootinfra 0.9.0-8.rhaos4.8.el8, python-sushy 3.7.4-0.20211119091058.2cc60dc.el8, +11 more Red Hat OpenShift Container Platform 4.9 haproxy 2.2.15-1.el8, cri-tools 1.22.0-1.el8, cri-tools 1.22.0-2.el7, python-cmd2 1.4.0-1.1.el8, ovn21.09 21.09.0-20.el8fdp, pycdlib-tools 1.11.0-3.el8, +102 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
crates.io coreos-installer
<0.10.0
0.10.0

Affected products

  • n/a coreos-installer

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.