Subject: [ASA-202107-70] containerd: directory traversal

Arch Linux Security Advisory ASA-202107-70
==========================================

Severity: Medium
Date    : 2021-07-27
CVE-ID  : CVE-2021-32760
Package : containerd
Type    : directory traversal
Remote  : No
Link    : https://security.archlinux.org/AVG-2174

Summary
=======

The package containerd before version 1.5.4-1 is vulnerable to
directory traversal.

Resolution
==========

Upgrade to 1.5.4-1.

# pacman -Syu "containerd>=1.5.4-1"

The problem has been fixed upstream in version 1.5.4.

Workaround
==========

As a workaround, ensure that users only pull images from trusted
sources. Linux security modules (LSMs) like AppArmor can limit the
files potentially affected by this bug through policies and profiles
that prevent containerd from interacting with specific files.

Description
===========

A bug was found in containerd version prior to 1.5.4 where pulling and
extracting a specially-crafted container image can result in Unix file
permission changes for existing files in the host's filesystem. Changes
to file permissions can deny access to the expected owner of the file,
widen access to others, or set extended bits like setuid, setgid, and
sticky. This bug does not directly allow files to be read, modified, or
executed without an additional cooperating process.

Impact
======

A crafted container image could change file permissions on the host
system, leading to potential denial of service or information
disclosure.

References
==========

https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj-rx3w
https://github.com/containerd/containerd/commit/37a44de17d5d09e258e3c8c29d32ae99797e7c11
https://security.archlinux.org/CVE-2021-32760