CVE-2021-21334: Github.com/containerd/containerd Containerd Environment Variable Leak Vulnerability

MODERATE
Advisory Identifier: GHSA-6g2q-w5j3-fwh4
Share
CVSS 6.3
CWE-668 CWE-200
Published
Advisory Summary

CVE-2021-21334 is a MODERATE (CVSS 6.3) containerd environment variable leak vulnerability (CWE-668: Exposure of Resource to Wrong Sphere) affecting Github.com/containerd/containerd libraries in the Go ecosystem. The issue involves containerd environment variable leak. Remediation is available by upgrading affected packages to version 1.4.4, 1.3.10.

CVE-2021-21334 at a Glance

CVE Identifier CVE-2021-21334
GHSA Identifier GHSA-6g2q-w5j3-fwh4
Severity MODERATE
CVSS v3.1 Base Score 6.3
CWE Classification CWE-668: Exposure of Resource to Wrong Sphere
Affected Product Github.com/containerd/containerd
Package Ecosystem Go
Published Date
Last Updated

Security Impact

CVSS: 6.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Changed (S:C)
Confidentiality High (C:H)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2021-21334

To remediate this vulnerability, upgrade all affected Github.com/containerd/containerd dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/containerd/containerd fixed: 1.4.4 
Upgrade github.com/containerd/containerd to 1.4.4
github.com/containerd/containerd fixed: 1.3.10 
Upgrade github.com/containerd/containerd to 1.3.10
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/containerd/containerd

How to Check if You Are Affected

To determine whether your application is affected by CVE-2021-21334, inspect your project dependencies for Github.com/containerd/containerd:

inspect dependencies for github.com/containerd/containerd

Analyze the terminal output to locate any version of Github.com/containerd/containerd in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.4.4), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-668: Exposure of Resource to Wrong Sphere, where the product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. In Github.com/containerd/containerd, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Impact Containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd’s CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue ## Patches This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions as soon as they are released. ## Workarounds There are no known workarounds. ## For more information If you have any questions or comments about this advisory: * [Open an issue](https://github.com/containerd/containerd/issues/new/choose) * Email us at security@containerd.io if you think you’ve found a security bug.

CVE-2021-21334 Affected Github.com/containerd/containerd Versions

2 component(s)
Fixed Versions:
1.4.41.3.10
Product / Package Ecosystem Affected Versions Fixed Version
github.com/containerd/containerd
golang/github.com/containerd/containerd
Go
≥ 1.4.0
< 1.4.4
1.4.4
github.com/containerd/containerd
golang/github.com/containerd/containerd
Go
< 1.3.10
1.3.10

References

GitHub Advisory / Wiki ADVISORY
https://github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4
NVD — CVE-2021-21334 NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21334
Github.com/containerd/containerd Source Repository REPOSITORY
https://github.com/containerd/cri/pull/1628
Github.com/containerd/containerd Source Repository REPOSITORY
https://github.com/containerd/cri/pull/1629
Security Fix Commit FIX COMMIT
https://github.com/containerd/containerd/commit/05f951a3781f4f2c1911b05e61c160e9c30eaa8e
Security Fix Commit FIX COMMIT
https://github.com/containerd/containerd/commit/2d9c8aa4b3f4313982c5c999af57212a1c5d144b
Security Fix Commit FIX COMMIT
https://github.com/containerd/containerd/commit/cbcb2f57fbe221986f96b552855eb802f63193de
Github.com/containerd/containerd Release RELEASE
https://github.com/containerd/containerd/releases/tag/v1.3.10
Github.com/containerd/containerd Release RELEASE
https://github.com/containerd/containerd/releases/tag/v1.4.4
lists.fedoraproject.org/archives/list/packa... WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUE2Z2ZUWBHRU36ZGBD2YSJCYB6ELPXE
lists.fedoraproject.org/archives/list/packa... WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QIBPKSX5IOWPM3ZPFB3JVLXWDHSZTTWT
lists.fedoraproject.org/archives/list/packa... WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VTXHA5JOWQRCCUZH7ZQBEYN6KZKJEYSD
Github.com/containerd/containerd Security Information SECURITY
https://security.gentoo.org/glsa/202105-33

Frequently Asked Questions

What is CVE-2021-21334?
CVE-2021-21334 is a security vulnerability in Github.com/containerd/containerd involving containerd environment variable leak under CWE-668: Exposure of Resource to Wrong Sphere.
Which Github.com/containerd/containerd versions are affected?
Affected versions include releases prior to 1.4.4, 1.3.10 across affected packages: github.com/containerd/containerd.
What version fixes CVE-2021-21334?
Upgrading to 1.4.4, 1.3.10 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/containerd/containerd affected?
Yes, github.com/containerd/containerd is affected in releases prior to 1.4.4, 1.3.10. Upgrade your dependency to 1.4.4, 1.3.10 or later.
What is the CVSS score of CVE-2021-21334?
CVE-2021-21334 has a CVSS v3.1 base score of 6.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N.
What CWE is associated with CVE-2021-21334?
CVE-2021-21334 is classified under CWE-668: Exposure of Resource to Wrong Sphere (The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.).
How can I check Go dependencies for CVE-2021-21334?
Run the dependency tree command: 'inspect dependencies for github.com/containerd/containerd'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6g2q-w5j3-fwh4",
  "modified" : "2024-01-31T23:22:45Z",
  "published" : "2024-01-31T23:22:45Z",
  "aliases" : [ "CVE-2021-21334" ],
  "summary" : "containerd environment variable leak",
  "details" : "## Impact\n\nContainers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers.  If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared.\n\nIf you are not using containerd’s CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue.\n\nIf you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue.\n\nIf you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue\n\n## Patches\n\nThis vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4.  Users should update to these versions as soon as they are released.\n\n## Workarounds\n\nThere are no known workarounds.\n\n## For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/containerd/containerd/issues/new/choose)\n* Email us at security@containerd.io if you think you’ve found a security bug.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/containerd/containerd"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.4.0"
      }, {
        "fixed" : "1.4.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/containerd/containerd"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.3.10"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-21334"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/containerd/cri/pull/1628"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/containerd/cri/pull/1629"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/containerd/containerd/commit/05f951a3781f4f2c1911b05e61c160e9c30eaa8e"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/containerd/containerd/commit/2d9c8aa4b3f4313982c5c999af57212a1c5d144b"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/containerd/containerd/commit/cbcb2f57fbe221986f96b552855eb802f63193de"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/containerd/containerd/releases/tag/v1.3.10"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/containerd/containerd/releases/tag/v1.4.4"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUE2Z2ZUWBHRU36ZGBD2YSJCYB6ELPXE"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QIBPKSX5IOWPM3ZPFB3JVLXWDHSZTTWT"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VTXHA5JOWQRCCUZH7ZQBEYN6KZKJEYSD"
  }, {
    "type" : "WEB",
    "url" : "https://security.gentoo.org/glsa/202105-33"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200", "CWE-668" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-01-31T23:22:45Z",
    "nvd_published_at" : "2021-03-10T22:15:00Z"
  }
}