Resource management error in containerd - CVE-2021-21334

Vulnerability identifier: #VU51242

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21334

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows an attacker to gain access to potentially sensitive information.

The vulnerability exists due to incorrect management of internal resources. Containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared.

containerd
Gentoo Linux
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE CaaS Platform
SUSE MicroOS
SUSE Enterprise Storage
SUSE Linux Enterprise Module for Containers
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
Ubuntu
Fedora
IBM Cloud Pak for Security
IBM MQ Operator
QRadar Suite
IBM Edge Application Manager
runc
runc-debuginfo
containerd (Ubuntu package)
containerd
golang-github-containerd-cri
docker
docker-debuginfo
Dell EMC VxRail Appliance

Install updates from vendor's website.

containerd - addressed in versions 1.3.10, 1.4.4
IBM MQ Operator - update to 2.0.0
QRadar Suite - update to 1.10.19.0
runc - update to 1.0.0~rc93-16.8.1
runc-debuginfo - update to 1.0.0~rc93-16.8.1
containerd (Ubuntu package) - addressed in versions 1.3.3-0ubuntu2.3, 1.3.7-0ubuntu3.3
containerd - update to 1.4.4-1.fc33
containerd - addressed in versions 1.4.4-5.32.1, 1.4.4-16.38.1
golang-github-containerd-cri - addressed in versions 1.19.0-3.20210307gitaa2d5a9.fc33, 1.19.0-3.20210307gitaa2d5a9.fc34
Dell EMC VxRail Appliance - update to 7.0.240
docker - update to 20.10.6_ce-98.66.1
docker-debuginfo - update to 20.10.6_ce-98.66.1

• https://github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4
• https://github.com/containerd/containerd/releases/tag/v1.3.10
• https://github.com/containerd/containerd/releases/tag/v1.4.4

• Information disclosure in containerd
• Gentoo update for containerd
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• SUSE update for containerd, docker, runc
• Ubuntu update for containerd
• Multiple vulnerabilities in IBM MQ Operator
• SUSE update for containerd, docker, runc
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM QRadar Suite Software
• Fedora 33 update for golang-github-containerd-cri
• Fedora 34 update for golang-github-containerd-cri
• Fedora 33 update for containerd