Vulnerability in containerd (DEBIAN-CVE-2021-41103)
Summary
Vulnerability in containerd (DEBIAN-CVE-2021-41103). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 1.5.7~ds1-1 or later.
Original description
The description as published by the source.
containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Users unable to update should limit access to the host to trusted users. Update directory permission on container bundles directories.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as DEBIAN-CVE-2021-41103 has been found in containerd.
Successful exploitation can lead to full system takeover.
What to do: upgrade containerd to 1.5.7~ds1-1 or later.
If unsure, ask your IT team or search "containerd DEBIAN-CVE-2021-41103" on the vendor's site.
DEBIAN-CVE-2021-41103 (containerd)
Attack vector: local / no user interaction
Patched: 1.5.7~ds1-1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (unclassified) exists in containerd.
Check the vendor advisory for the affected versions of containerd.
Severity: ?. Successful exploitation can lead to full system takeover.
Update to 1.5.7~ds1-1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'containerd' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'containerd' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
containerdを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade containerd to 1.5.7~ds1-1ステージング環境で 1.5.7~ds1-1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory security-tracker.debian.org