GHSA-6g2q-w5j3-fwh4 CVE-2021-21334
containerd environment variable leak
- Severity
- 6.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 1.95%
- Chance of exploitation in the next 30 days. Higher than 80.20% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-668 Exposure of Resource to Wrong Sphere
- Fix
1.4.4- Upgrade github.com/containerd/containerd to this version or later
Description
Impact
Containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared.
If you are not using containerd’s CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue.
If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue.
If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue
Patches
This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions as soon as they are released.
Workarounds
There are no known workarounds.
For more information
If you have any questions or comments about this advisory:
- Open an issue
- Email us at security@containerd.io if you think you’ve found a security bug.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/containerd/containerd | >= 1.4.0, < 1.4.4 |
1.4.4 |
| github.com/containerd/containerd | < 1.3.10 |
1.3.10 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/containerd/containerd Go → 1.4.4
- go
go get github.com/containerd/containerd@v1.4.4 && go mod tidy
Severity breakdown
CVSS 3.1 6.3
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
References
Advisories
Other links
- github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4
- github.com/containerd/cri/pull/1628
- github.com/containerd/cri/pull/1629
- github.com/containerd/containerd/commit/05f951a3781f4f2c1911b05e61c160e9c30eaa8e
- github.com/containerd/containerd/commit/2d9c8aa4b3f4313982c5c999af57212a1c5d144b
- github.com/containerd/containerd/commit/cbcb2f57fbe221986f96b552855eb802f63193de
- github.com/containerd/containerd/releases/tag/v1.3.10
- github.com/containerd/containerd/releases/tag/v1.4.4
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUE2Z…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QIBPK…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VTXHA…
- security.gentoo.org/glsa/202105-33
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rp3h-jf77-q9p4 containerd: Unpack DoS via repeated opaque whiteouts | Medium | Also affects github.com/containerd/containerd |
| GO-2026-6791 containerd CRI plugin: Checkpoint restore bypasses destination security context | High | Also affects github.com/containerd/containerd |
| GHSA-pg57-6jwg-q645 Containerd has image-pull DoS via crafted OCI index graph amplification | Medium | Also affects github.com/containerd/containerd |
| GHSA-7jxh-36q5-gcqv containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service | Medium | Also affects github.com/containerd/containerd |
| GO-2026-5064 containerd CRI checkpoint restore CDI annotation smuggling | Critical | Also affects github.com/containerd/containerd |
| GO-2026-5622 Arbitrary host CRI log file read via symlink following in CRI checkpoint restore | Medium | Also affects github.com/containerd/containerd |
| GHSA-xhf5-7wjv-pqxp containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull | High | Also affects github.com/containerd/containerd |
| GO-2026-5338 containerd: CRI checkpoint import allows local image tag poisoning | Critical | Also affects github.com/containerd/containerd |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor