Lucene search

K
cvelistOpenEulerCVELIST:CVE-2021-33634
HistoryOct 29, 2023 - 7:51 a.m.

CVE-2021-33634 Malicious image running containers may cause DoS attacks

2023-10-2907:51:49
CWE-665
openEuler
www.cve.org
1
cve-2021-33634
malicious image
denial of service
isulad
containers
lcr+lxc runtime

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

AI Score

6.7

Confidence

High

EPSS

0

Percentile

10.3%

iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.

CNA Affected

[
  {
    "collectionURL": "https://gitee.com/src-openeuler",
    "defaultStatus": "unaffected",
    "modules": [
      "runtime"
    ],
    "packageName": "lcr",
    "platforms": [
      "Linux"
    ],
    "product": "lcr",
    "programFiles": [
      "https://gitee.com/openeuler/lcr/blob/master/src/runtime/lcrcontainer.c"
    ],
    "repo": "https://gitee.com/src-openeuler/lcr",
    "vendor": "openEuler",
    "versions": [
      {
        "changes": [
          {
            "at": "0012-265-set-env-to-avoid-invoke-lxc-binary-directly.patch",
            "status": "unaffected"
          },
          {
            "at": "0008-266-set-env-to-avoid-invoke-lxc-binary-directly.patch",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "2.0.9-6,2.1.2-3",
        "status": "affected",
        "version": "0",
        "versionType": "patch"
      }
    ]
  }
]

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

AI Score

6.7

Confidence

High

EPSS

0

Percentile

10.3%

Related for CVELIST:CVE-2021-33634