PT-2021-7623 · Unknown+6 · Kubernetes Containerd+5

Mcgowan · Published 2021-03-05 · Updated 2024-06-15 · CVE-2021-21334

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions containerd versions prior to 1.3.10 containerd versions prior to 1.4.4

Description The issue is related to the disclosure of information in the error data area of the containerd runtime environment. Containers launched through containerd's CRI implementation that share the same image may receive incorrect environment variables, including values defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared.

Recommendations Update to containerd version 1.3.10 or later. Update to containerd version 1.4.4 or later. As a temporary workaround, consider avoiding the launch of multiple containers or Kubernetes pods from the same image with different environment variables in rapid succession. Restrict the use of containerd's CRI implementation to minimize the risk of exploitation.

Fix

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

ALT-PU-2021-1464

ALT-PU-2022-1248

AZL-44910

BDU:2023-00284

CVE-2021-21334

GHSA-6G2Q-W5J3-FWH4

MGASA-2021-0248

OPENSUSE-SU-2021:0878-1

OPENSUSE-SU-2021:1954-1

OPENSUSE-SU-2021_0878-1

OPENSUSE-SU-2021_1954-1

OPENSUSE-SU-2024:10693-1

SUSE-SU-2021:1458-1

SUSE-SU-2021:1954-1

USN-4881-1

Affected Products

Alt Linux

Astra Linux

Kubernetes Containerd

Linuxmint

Suse

Ubuntu

References · 93

• https://github.com/containerd/containerd/commit/05f951a3781f4f2c1911b05e61c160e9c30eaa8e · Patch
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1221SE17MD · Vendor Advisory
• https://security.gentoo.org/glsa/202105-33 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21334 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21334 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-21334 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21334 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VTXHA5JOWQRCCUZH7ZQBEYN6KZKJEYSD · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0248.html · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0248 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21334 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KUE2Z2ZUWBHRU36ZGBD2YSJCYB6ELPXE · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00284 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QIBPKSX5IOWPM3ZPFB3JVLXWDHSZTTWT · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10693-1 · Vendor Advisory