Skip to content
Fencer Vulns
medium 5.9

CVE-2021-41103 json

Insufficiently restricted permissions on plugin directories

published 2021-10-04 5 y ago modified 2026-09-10 1 mo ago also GHSA-c2h3-6mxw-7mvq , GO-2022-0938 , EUVD-2021-2187

cvss
5.9
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Users unable to update should limit access to the host to trusted users. Update directory permission on container bundles directories.

Patch / fix

  • go github.com/containerd/containerd 1.4.11, 1.5.7
  • linuxfoundation containerd 1.4.11, 1.5.7
  • containerd Debian 14, Debian 13, Debian 12 1.5.7~ds1-1

debian advisories DEBIAN-CVE-2021-41103

  • containerd Ubuntu 18.04 LTS 1.5.2-0ubuntu1~18.04.3
  • containerd Ubuntu 20.04 LTS 1.5.2-0ubuntu1~20.04.3
  • containerd Ubuntu 22.04 LTS 1.5.5-0ubuntu3
  • containerd Ubuntu Pro 16.04 LTS 1.2.6-0ubuntu1~16.04.6+esm2

ubuntu advisories UBUNTU-CVE-2021-41103

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 24.0.9_ce-150000.1.25.1
  • docker SLE Module for Containers 15 SP3, SLE Micro 5.1, SLE Micro 5.0 20.10.12_ce-159.1
  • containerd SLE Module for Containers 15 SP3, SLE Micro 5.1, SLE Micro 5.0 1.4.12-60.1
  • docker SLE Module for Containers 12 20.10.12_ce-98.75.1
  • containerd SLE Module for Containers 12 1.4.12-16.49.1
  • runc SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 1.0.2-23.1
  • docker SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +11 more 20.10.9_ce-156.1
  • containerd SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +11 more 1.4.11-56.1

suse advisories SUSE-SU-2025:03545-1SUSE-SU-2025:03540-1SUSE-SU-2022:0334-1SUSE-SU-2022:0213-1SUSE-SU-2021:3506-1SUSE-SU-2021:3336-1

  • containerd openSUSE Tumbleweed 1.4.11-1.1
  • docker openSUSE Leap 15.3 20.10.12_ce-159.1
  • containerd openSUSE Leap 15.3 1.4.12-60.1
  • docker-kubic openSUSE Leap 15.3 20.10.12_ce-159.1
  • runc openSUSE Leap 15.2 1.0.2-lp152.2.9.1
  • docker openSUSE Leap 15.2 20.10.9_ce-lp152.2.18.1
  • containerd openSUSE Leap 15.2 1.4.11-lp152.2.12.1
  • runc openSUSE Leap 15.3 1.0.2-23.1

opensuse advisories openSUSE-SU-2024:11565-1openSUSE-SU-2022:0334-1openSUSE-SU-2021:1404-1openSUSE-SU-2021:3506-1

  • containerd Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.5.7-r0

alpine advisories ALPINE-CVE-2021-41103

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • moby-containerd CBL-Mariner 2.0 1.4.4+azure-4

azure linux advisories AZL-6681

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • containerd Arch Linux 1.5.7-1

arch linux advisories AVG-2439

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-41103 updated cvss 5.9

containerd: insufficiently restricted permissions on container root and plugin directories

  • Red Hat OpenStack Platform 16.2 osp-director-provisioner-container, rhosp-rhel8-tech-preview/osp-director-downloader
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenStack Platform 16.2 rhosp-rhel8-tech-preview/osp-director-operator 1.2.3-3, rhosp-rhel8-tech-preview/osp-director-operator 1.2.3-4, rhosp-rhel8-tech-preview/osp-director-operator-bundle 1.2.3-7
    fixed: vendor fix RHSA-2022:6517
  • Red Hat Advanced Cluster Management for Kubernetes 2 containerd Red Hat OpenStack Platform 16.2 rhosp-rhel8-tech-preview/osp-director-downloader 1.2.3-3, rhosp-rhel8-tech-preview/osp-director-operator-bundle 1.2.3-5
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-167-09 updated cvss 5.9

Siemens SCALANCE LPE9403 Third-Party Vulnerabilities

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 5.9 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C
GitHub 3.0 5.9 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
go github.com/containerd/containerd
<1.4.11
>=1.5.0, <1.5.7
1.4.11
1.5.7

Affected products

  • containerd containerd

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.