CVE-2021-43816

Description

An incorrect permission assignment flaw was found in containerd. This flaw allows a local attacker to use a specially designed text file to read and write files outside of the container's scope.

Statement

Because Red Hat OpenStack Platform's director-operator does not use hostPath volumes, the RHOSP Impact has been rated Low impact and no updates will be provided at this time for its containers.

In Red Hat OpenShift Container Platform (OCP) the containerd package is not actually used, but because the containerd API is supported the core OCP components are listed as affected by this CVE and the impact is reduced to Low.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score89.18
Attack VectorNetworkNetworkNetwork
Attack ComplexityHighLowHigh
Privileges RequiredHighHighHigh
User InteractionNoneNoneNone
ScopeChangedChangedChanged
ConfidentialityHighHighHigh
Integrity ImpactHighHighHigh
Availability ImpactHighHighHigh

Vector

Red Hat: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

NVD: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

cve.org: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Red Hat CVSS v3 Score Explanation

Successful exploitation of this flaw requires some knowledge of the host's file structure, therefore attack complexity is rated high.

Understanding the Weakness (CWE)

CWE-281

Confidentiality,Integrity

Technical Impact: Read Application Data; Modify Application Data

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.