CVE-2021-20206 containernetworking/cni improper limitation of path name

High 7.2 Published 26 Mar 2021 Updated 3 Aug 2024

Attackers can execute arbitrary system binaries via path traversal in CNI plugin configuration, compromising container network integrity and availability.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-20206?

CVE-2021-20206 is a high-severity path traversal vulnerability in containernetworking-cni, published on 26 Mar 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Weakness: CWE-22, CWE-20

Which versions are affected by CVE-2021-20206?

3 open source packages ship an affected version, including github.com/containernetworking/cni. It affects 1 product.

Package	Affected	Fixed in
`github.com/containernetworking/cni` Go	All versions	`0.8.1`
`github.com/containernetworking/cni` Go	All versions	`0.8.1`
`github.com/containernetworking/cni` Go	All versions	`0.8.1`

Linux distribution packages (37)

`cni` SUSE:Enterprise Storage 6	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Enterprise Storage 6	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Enterprise Storage 7	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Enterprise Storage 7	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Enterprise Storage 7.1	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Enterprise Storage 7.1	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise Micro 5.1	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise Micro 5.1	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise Micro 5.2	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise Micro 5.2	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise Micro 5.3	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise Micro 5.3	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise Module for Containers 15 SP3	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise Module for Containers 15 SP3	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise Module for Containers 15 SP4	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise Module for Containers 15 SP4	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise Module for Public Cloud 15	All versions	`0.7.1-150000.1.7.1`
`cni` SUSE:Linux Enterprise Module for Public Cloud 15 SP1	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise Module for Public Cloud 15 SP1	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise Module for Public Cloud 15 SP2	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise Module for Public Cloud 15 SP2	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise Server 15 SP1-BCL	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise Server 15 SP1-BCL	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise Server 15 SP1-LTSS	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise Server 15 SP1-LTSS	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise Server 15 SP2-BCL	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise Server 15 SP2-BCL	All versions	`0.8.6-150100.3.11.1`
`cni` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`0.7.1-150100.3.8.1`
`cni-plugins` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`0.8.6-150100.3.11.1`

Products include Linuxfoundation Container Network Interface.

How do I fix CVE-2021-20206?

Upgrade github.com/containernetworking/cni to 0.8.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-20206 being exploited?

There is no known exploitation of CVE-2021-20206 in the wild and no public exploit code.

Sources

Also known as AZL-44838, CLEANSTART-2024-OS27994, DEBIAN-CVE-2021-20206, GHSA-xjqr-g762-pxwp, GO-2022-0230, SNYK-GOLANG-GITHUBCOMCONTAINERNETWORKINGCNIPKGINVOKE-1070549 and 7 more.