CVE-2021-32760

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-668CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Jul 19, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-327617.5Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow eCVE-2021-327628.8Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulneraCVE-2021-327636.5OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProjecCVE-2021-327645.4Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susCVE-2021-327658.8Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provideCVE-2021-327665.3Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud TexCVE-2021-327676.5TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 througCVE-2021-327686.1TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, CVE-2021-327697.5Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versionCVE-2021-32777.2Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in CVE-2021-327707.5Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP BasicCVE-2021-327718.1Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflo
CVE-2021-32760: Medium severity, CVSS 6.3 | Vulnix