REDHAT-BUG-2413190: High severity containerd containerd vulnerability
containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri and /run/containerd/io.containerd.sandbox.controller.v1.shim were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.7.29 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.1.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.0 - Configuration
Update system administrator permissions so the host manually chmods the directories /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri, and /run/containerd/io.containerd.sandbox.controller.v1.shim to remove group/world accessible permissions.
containerd host filesystem permissions permissions on /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri, /run/containerd/io.containerd.sandbox.controller.v1.shim = not group- or world-accessible - Compensating control
Run containerd in rootless mode as a workaround for the overly broad default permission vulnerability.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2413190?
The severity of REDHAT-BUG-2413190 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2413190?
To fix REDHAT-BUG-2413190, update to a patched version of containerd that addresses the overly broad default permission vulnerability.
What versions are affected by REDHAT-BUG-2413190?
Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 are affected by REDHAT-BUG-2413190.
What is the main issue with REDHAT-BUG-2413190?
The main issue with REDHAT-BUG-2413190 is an overly broad default permission vulnerability in containerd that could lead to unauthorized access.
What directories are involved in REDHAT-BUG-2413190?
The directories involved in REDHAT-BUG-2413190 include `/var/lib/containerd` and `/run/containerd/io.containerd.grpc...`.