Every CVE Search/ Get API key

CVE-2021-3917

coreos-installer < 0.10.0 writes world-readable Ignition config to installed system

5.5 MediumFix available

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.24%Down 0.7 points since Aug 24, 2022
90%50%10%1%

What each source reports

NVD Score used 5.5

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.

Record
CVE-2021-3917
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-276
Updated
2026-11-02
CVE List No score

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.

Record
CVE-2021-3917
Weakness
CWE-276
Updated
2026-11-02
EUVDEUVD-2021-2318 No score

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.

Record
EUVD-2021-2318
Updated
2026-11-03
GitHub AdvisoriesGHSA-862g-9h5m-m3qv 5.5

coreos-installer < 0.10.0 writes world-readable Ignition config to installed system

Impact

On systems installed with coreos-installer before 0.10.0, the user-provided Ignition config was written to /boot/ignition/config.ign with world-readable permissions, granting unprivileged users access to any secrets included in the config.

Default configurations of Fedora CoreOS and RHEL CoreOS do not include any unprivileged user accounts. In addition, instances launched from a cloud image, and systems provisioned with the ignition.config.url kernel argument, do not use the config.ign file and are unaffected.

Patches

coreos-installer 0.10.0 and later writes the Ignition config with restricted permissions.

Workarounds

On Fedora CoreOS systems installed from version 34.20210711.3.0 (stable), 34.20210711.2.0 (testing), 34.20210711.1.1 (next) and later, the /boot/ignition directory and its contents are removed after provisioning is complete. All Fedora CoreOS systems that have updated to these versions or later have automatically removed the /boot/ignition directory and no action is required.

On other systems, /boot/ignition/config.ign can be removed manually, as it is not used after provisioning is complete:

sudo mount -o remount,rw /boot
sudo rm -rf /boot/ignition

References

For more information, see https://github.com/coreos/fedora-coreos-tracker/issues/889.

For more information

If you have any questions or comments about this advisory, open an issue in coreos-installer or email the CoreOS development mailing list.

Record
GHSA-862g-9h5m-m3qv
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-276
Updated
2026-11-02
OSV 5.5

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.

Record
CVE-2021-3917
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-862g-9h5m-m3qv 5.5

coreos-installer < 0.10.0 writes world-readable Ignition config to installed system

Impact

On systems installed with coreos-installer before 0.10.0, the user-provided Ignition config was written to /boot/ignition/config.ign with world-readable permissions, granting unprivileged users access to any secrets included in the config.

Default configurations of Fedora CoreOS and RHEL CoreOS do not include any unprivileged user accounts. In addition, instances launched from a cloud image, and systems provisioned with the ignition.config.url kernel argument, do not use the config.ign file and are unaffected.

Patches

coreos-installer 0.10.0 and later writes the Ignition config with restricted permissions.

Workarounds

On Fedora CoreOS systems installed from version 34.20210711.3.0 (stable), 34.20210711.2.0 (testing), 34.20210711.1.1 (next) and later, the /boot/ignition directory and its contents are removed after provisioning is complete. All Fedora CoreOS systems that have updated to these versions or later have automatically removed the /boot/ignition directory and no action is required.

On other systems, /boot/ignition/config.ign can be removed manually, as it is not used after provisioning is complete:

sudo mount -o remount,rw /boot
sudo rm -rf /boot/ignition

References

For more information, see https://github.com/coreos/fedora-coreos-tracker/issues/889.

For more information

If you have any questions or comments about this advisory, open an issue in coreos-installer or email the CoreOS development mailing list.

Record
GHSA-862g-9h5m-m3qv
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-276
Updated
2026-11-02
OSVRHSA-2021:3758 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.9.0 packages and security update

Record
RHSA-2021:3758
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:4829 9.0

Red Hat Security Advisory: OpenShift Container Platform 4.8.22 security update

Record
RHSA-2021:4829
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
coreos-installer
crates.io
 before 0.10.0
0.10.0
coreos-installer
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:0.10.0-2.rhaos4.9.el8
0:0.10.0-2.rhaos4.9.el8
coreos-installer-bootinfra
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:0.10.0-2.rhaos4.9.el8
0:0.10.0-2.rhaos4.9.el8
coreos-installer-bootinfra-debuginfo
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:0.10.0-2.rhaos4.9.el8
0:0.10.0-2.rhaos4.9.el8
coreos-installer-debuginfo
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:0.10.0-2.rhaos4.9.el8
0:0.10.0-2.rhaos4.9.el8
coreos-installer-debugsource
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:0.10.0-2.rhaos4.9.el8
0:0.10.0-2.rhaos4.9.el8
jenkins
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.289.3.1630554997-1.el8
0:2.289.3.1630554997-1.el8
openshift
Red Hat:openshift:4.9::el7
From an advisory covering 5 CVEs
 before 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7
0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7
openshift-hyperkube
Red Hat:openshift:4.9::el7
From an advisory covering 5 CVEs
 before 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7
0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7
openshift
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
Show 13 moreShow less
Affected packages
PackageAffectedFixed
openshift-hyperkube
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
network-scripts-openvswitch2.15
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
openvswitch2.15
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
openvswitch2.15-debuginfo
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
openvswitch2.15-debugsource
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
openvswitch2.15-devel
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
openvswitch2.15-ipsec
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
openvswitch2.15-test
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
python3-openvswitch2.15
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
python3-openvswitch2.15-debuginfo
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
coreos-installer
Red Hat:openshift:4.8::el8
From an advisory covering 15 CVEs
 before 0:0.9.0-8.rhaos4.8.el8
0:0.9.0-8.rhaos4.8.el8
jenkins
Red Hat:openshift:4.8::el8
From an advisory covering 15 CVEs
 before 0:2.303.3.1637596565-1.el8
0:2.303.3.1637596565-1.el8
jenkins-2-plugins
Red Hat:openshift:4.8::el8
From an advisory covering 15 CVEs
 before 0:4.8.1637599935-1.el8
0:4.8.1637599935-1.el8

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3917 is a medium vulnerability (CVSS 5.5) in Redhat Coreos-installer, published November 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. Fixed in coreos-installer 0.10.0.

References

Show 85 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open