CVE-2021-32760

mediumpriority · track · 26EPSS 0.016 · 76 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.59% (76th) EPSS

CVSS 6.8 · medium

Is it mine?

17 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.

cvss

Technical severity, 0–10. One row per scoring source.

6.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.06.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8.6 · impact 6.4

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:Lprimary · NVD / NIST USexploitability 2.8 · impact 3.4

v3.15mediumAV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU

v3.15mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · ENISA EU

v3.15mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · security-advisories@github.comexploitability 1.6 · impact 3.4

v3.15mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · OSV

v3.15.8mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-732USprimaryCWE-264USCWE-281USCWE-668USCWE-668USCWE-668USCWE-732US

affected products (17)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Amazon Linux 2 pluginsall versionscert_bundDEcpe:/o:amazon:linux_2:plugins
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
containerd containerd≤ ≤ 1.4.7enisa_euvdEU
containerd containerd≤ 1.5.0, ≤ 1.5.3enisa_euvdEU
Cloud Native Computing Foundation Containerd1.4.0 → 1.4.8fstec_bduRU
Cloud Native Computing Foundation Containerd1.5.0 → 1.5.4fstec_bduRU
АО «ИВК» Альт 8 СПall versionsfstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 4.7fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.7fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 11fstec_bduRU
fedoraproject fedora= 34nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
linuxfoundation containerd< 1.4.8nvdUScpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*
linuxfoundation containerd1.5.0 → 1.5.4nvdUScpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*
Go github.com/containerd/containerd< 1.4.8osvUSpkg:golang/github.com/containerd/containerd
Go github.com/containerd/containerd1.5.0 → 1.5.4osvUSpkg:golang/github.com/containerd/containerd

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-1002Amazon Linux 2: Mehrere SchwachstellenDeutsch2021-12-08csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen in Amazon Linux 2 ausnutzen, um Informationen offenzulegen, Dateien zu manipulieren oder falsche Informationen darzustellen.
GHSA-c72p-9xmj-rx3wArchive package allows chmod of file outside of unpack target directory2021-07-26ghsa · osvUS
## Impact A bug was found in containerd where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. ## Patches This bug has been fixed in containerd 1.5.4 and 1.4.8. Users should update to these versions as soon as they are released. Running containers do not need to be restarted. ## Workarounds Ensure you only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with unexpected files. ## For more information If you have any questions or comments about this advisory: * [Open an issue](https://github.com/containerd/containerd/issues/new/choose) * Email us at security@containerd.io if you think you’ve found a security bug.
GO-2022-0921Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd2024-08-21vendor · osvUS
Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2021-07-19modified 2026-06-17

related (1,935)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2022-22960US	high7.8OT critical	35.5% (98th)	KEV	2022-04-13
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor…
CVE-2021-23874US	high7.8OT critical	1.03% (63rd)	KEV	2021-02-10
Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP…
CVE-2019-15752US	high7.8OT critical	48.6% (99th)	KEV	2019-08-28
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\ve…
CVE-2018-13374US	medium4.3OT critical	38.1% (99th)	KEV	2019-01-22
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials co…
CVE-2021-25646US	high8.8	99.1% (100th)	Exploit	2021-01-29
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments,…

+1930 more

references (25)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan