Description
containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| containerd | containerd | <= 1.4.7, >= 1.5.0, <= 1.5.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | containerd | 1.4.5~ds1-2 | — |
| Debian 13 | containerd | 1.4.5~ds1-2 | — |
| Debian 12 | containerd | 1.4.5~ds1-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | containerd | 1.5.2-0ubuntu1~20.04.2 | USN-5012-1 |
| Ubuntu 18.04 LTS | containerd | 1.5.2-0ubuntu1~18.04.2 | USN-5012-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | containerd | 1.2.6-0ubuntu1~16.04.6+esm2 | USN-5521-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | containerd | 1.4.4-5.36.1 | SUSE-SU-2021:3506-1, SUSE-SU-2021:2412-1 |
| SLES 15 SP3 | docker | 20.10.9_ce-156.1 | SUSE-SU-2021:3506-1 |
| SLES 15 SP3 | runc | 1.0.2-23.1 | SUSE-SU-2021:3506-1 |
| SLES 15 SP2 | containerd | 1.4.4-5.36.1 | SUSE-SU-2021:3506-1, SUSE-SU-2021:2412-1 |
| SLES 15 SP2 | docker | 20.10.9_ce-156.1 | SUSE-SU-2021:3506-1 |
| SLES 15 SP2 | runc | 1.0.2-23.1 | SUSE-SU-2021:3506-1 |
| SLES 15 SP1 | containerd | 1.4.11-56.1 | SUSE-SU-2021:3506-1 |
| SLES 15 SP1 | docker | 20.10.9_ce-156.1 | SUSE-SU-2021:3506-1 |
| SLES 15 SP1 | runc | 1.0.2-23.1 | SUSE-SU-2021:3506-1 |
| SLES 15 | containerd | 1.4.11-56.1 | SUSE-SU-2021:3506-1 |
| SLES 15 | docker | 20.10.9_ce-156.1 | SUSE-SU-2021:3506-1 |
| SLES 15 | runc | 1.0.2-23.1 | SUSE-SU-2021:3506-1 |
| SLES 12 | containerd | 1.4.4-16.42.1 | SUSE-SU-2021:3336-1, SUSE-SU-2021:2413-1 |
| SLES 12 | docker | 20.10.9_ce-98.72.1 | SUSE-SU-2021:3336-1 |
| SLES 12 | runc | 1.0.2-16.14.1 | SUSE-SU-2021:3336-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP1 | containerd | 1.4.11-56.1 | SUSE-SU-2021:3506-1 |
| SLES for SAP 15 SP1 | docker | 20.10.9_ce-156.1 | SUSE-SU-2021:3506-1 |
| SLES for SAP 15 SP1 | runc | 1.0.2-23.1 | SUSE-SU-2021:3506-1 |
| SLES for SAP 15 | containerd | 1.4.11-56.1 | SUSE-SU-2021:3506-1 |
| SLES for SAP 15 | docker | 20.10.9_ce-156.1 | SUSE-SU-2021:3506-1 |
| SLES for SAP 15 | runc | 1.0.2-23.1 | SUSE-SU-2021:3506-1 |
| SLE Micro 5.1 | containerd | 1.4.11-56.1 | SUSE-SU-2021:3506-1 |
| SLE Micro 5.1 | docker | 20.10.9_ce-156.1 | SUSE-SU-2021:3506-1 |
| SLE Micro 5.1 | runc | 1.0.2-23.1 | SUSE-SU-2021:3506-1 |
| SLE Micro 5.0 | containerd | 1.4.4-5.36.1 | SUSE-SU-2021:3506-1, SUSE-SU-2021:2412-1 |
| SLE Micro 5.0 | docker | 20.10.9_ce-156.1 | SUSE-SU-2021:3506-1 |
| SLE Micro 5.0 | runc | 1.0.2-23.1 | SUSE-SU-2021:3506-1 |
| SLE HPC 15 SP1 | containerd | 1.4.11-56.1 | SUSE-SU-2021:3506-1 |
| SLE HPC 15 SP1 | docker | 20.10.9_ce-156.1 | SUSE-SU-2021:3506-1 |
| SLE HPC 15 SP1 | runc | 1.0.2-23.1 | SUSE-SU-2021:3506-1 |
| SLE HPC 15 | containerd | 1.4.11-56.1 | SUSE-SU-2021:3506-1 |
| SLE HPC 15 | docker | 20.10.9_ce-156.1 | SUSE-SU-2021:3506-1 |
| SLE HPC 15 | runc | 1.0.2-23.1 | SUSE-SU-2021:3506-1 |
| SUSE Enterprise Storage 7 | runc | 1.0.2-23.1 | SUSE-SU-2021:3506-1 |
| SUSE Enterprise Storage 6 | containerd | 1.4.11-56.1 | SUSE-SU-2021:3506-1 |
| SUSE Enterprise Storage 6 | docker | 20.10.9_ce-156.1 | SUSE-SU-2021:3506-1 |
| SUSE Enterprise Storage 6 | runc | 1.0.2-23.1 | SUSE-SU-2021:3506-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | containerd | 1.4.8-2.2 | openSUSE-SU-2024:10693-1 |
| openSUSE Tumbleweed | trivy | 0.20.2-1.1 | openSUSE-SU-2024:11619-1 |
| openSUSE Leap 15.3 | containerd | 1.4.4-5.36.1 | openSUSE-SU-2021:3506-1, openSUSE-SU-2021:2412-1 |
| openSUSE Leap 15.3 | docker +1 | 20.10.9_ce-156.1 | openSUSE-SU-2021:3506-1 |
| openSUSE Leap 15.3 | runc | 1.0.2-23.1 | openSUSE-SU-2021:3506-1 |
| openSUSE Leap 15.2 | containerd | 1.4.4-lp152.2.9.1 | openSUSE-SU-2021:1404-1, openSUSE-SU-2021:1081-1 |
| openSUSE Leap 15.2 | docker | 20.10.9_ce-lp152.2.18.1 | openSUSE-SU-2021:1404-1 |
| openSUSE Leap 15.2 | runc | 1.0.2-lp152.2.9.1 | openSUSE-SU-2021:1404-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | containerd | 1.5.4-r0 | — |
| Alpine v3.23 | containerd | 1.5.4-r0 | — |
| Alpine v3.22 | containerd | 1.5.4-r0 | — |
| Alpine v3.21 | containerd | 1.5.4-r0 | — |
| Alpine v3.20 | containerd | 1.5.4-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | containerd | 1.5.4-r0 | — |
| Alpine v3.18 | containerd | 1.5.4-r0 | — |
| Alpine v3.17 | containerd | 1.5.4-r0 | — |
| Alpine v3.16 | containerd | 1.5.4-r0 | — |
| Alpine v3.15 | containerd | 1.5.4-r0 | — |
| Alpine v3.14 | containerd | 1.5.4-r0 | — |
| Alpine v3.13 | containerd | 1.4.8-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | moby-containerd | 1.4.4+azure-4 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | containerd | 1.4.8-1.el7 | ELSA-2021-15790, ELSA-2021-9373 |
| Oracle Linux 7 | docker-cli +1 | 19.03.11.ol-13.el7 | ELSA-2021-15790, ELSA-2021-9373 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ctop | 0.7.7-r13 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/containerd/containerd | < 1.4.8 | 1.4.8 | GHSA-c72p-9xmj-rx3w |
| Go | github.com/containerd/containerd | >= 1.5.0, < 1.5.4 | 1.5.4 | GHSA-c72p-9xmj-rx3w |
| Go | github.com/containerd/containerd | < 1.4.8 · >= 1.5.0, < 1.5.4 | 1.4.8, 1.5.4 | GO-2022-0921 |
Advisories 15
- USN-5521-1 containerd vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5012-1 containerd vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2021:1404-1 Security update for containerd, docker, runc SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1081-1 Security update for containerd SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2412-1 Security update for containerd SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2413-1 Security update for containerd SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3506-1 Security update for containerd, docker, runc SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10693-1 containerd-1.4.8-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11619-1 trivy-0.20.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:3506-1 Security update for containerd, docker, runc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3336-1 Security update for containerd, docker, runc SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:2412-1 Security update for containerd SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-1002 Amazon Linux 2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 16, 2023
- ELSA-2021-9373 Important: containerd security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 23, 2021
- ELSA-2021-15790 Important: containerd security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 23, 2021