Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 573
Alerts This Week
Warning Icon 1 573

Ubuntu 21.04: USN-5100-1 Critical: containerd File Access Threat

ubuntu
Calendar Grey October 4, 2021
Dist Ubuntu Esm H88
October 12, 2021, Ubuntu Security Notice USN-5105-1 discusses vulnerabilities in glibc impacting various Ubuntu distributions.
containerd would allow unintended access to files.

Summary

containerd would allow unintended access to files.

Software Description:

- containerd: daemon to control runC

Details:

It was discovered that containerd insufficiently restricted permissions on

container root and plugin directories. If a user or automated system were

tricked into launching a specially crafted container image, a remote

attacker could traverse directory contents and modify files and execute

programs on the host filesystem, possibly leading to privilege escalation.

Topics%20covered

Topics Covered

security advisory critical privilege escalation Ubuntu update instructions file access containerd

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.04:
  containerd                      1.5.2-0ubuntu1~21.04.3

Ubuntu 20.04 LTS:
  containerd                      1.5.2-0ubuntu1~20.04.3

Ubuntu 18.04 LTS:
  containerd                      1.5.2-0ubuntu1~18.04.3

After a standard system update you need to restart containerd to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5100-1

CVE-2021-41103

Severity
critical
Lowest
Low
Medium
High
Critical

October 04, 2021

Topics%20covered

Topics Covered

security advisory critical privilege escalation Ubuntu update instructions file access containerd

Package Information

https://launchpad.net/ubuntu/+source/containerd/1.5.2-0ubuntu1~21.04.3
https://launchpad.net/ubuntu/+source/containerd/1.5.2-0ubuntu1~20.04.3
https://launchpad.net/ubuntu/+source/containerd/1.5.2-0ubuntu1~18.04.3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.