CVE-2021-33634
Malicious image running containers may cause DoS attacks
iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Malicious image running containers may cause DoS attacks
iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.
- Record
CVE-2021-33634- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H - Weakness
- CWE-665
- Updated
- 2026-11-02
EUVDEUVD-2021-20311
iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.
- Record
EUVD-2021-20311- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5mrv-f9xf-hpqp
iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.
iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.
- Record
GHSA-5mrv-f9xf-hpqp- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H - Weakness
- CWE-665
- Updated
- 2026-11-02
NVD
iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.
- Record
CVE-2021-33634- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-665
- Updated
- 2026-11-02
OSVOESA-2023-1692
lcr security update
Security Fix(es):
Isula uses the lxc runtime (default) to run malicious images, which can cause DOS.(CVE-2021-33634)
- Record
OESA-2023-1692- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lcropenEuler:20.03-LTS-SP1 |
before 2.0.5-20210518.110612.git5225bddc.oe1 | 2.0.5-20210518.110612.git5225bddc.oe1 |
lcropenEuler:20.03-LTS-SP3 |
before 2.0.9-7.oe1 | 2.0.9-7.oe1 |
lcropenEuler:22.03-LTS |
before 2.1.2-5.oe2203sp2 | 2.1.2-5.oe2203sp2 |
lcropenEuler:22.03-LTS-SP1 |
before 2.0.9-7.oe2203sp1 | 2.0.9-7.oe2203sp1 |
lcropenEuler:22.03-LTS-SP2 |
before 2.1.2-5.oe2203sp2 | 2.1.2-5.oe2203sp2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-33634 is a medium vulnerability (CVSS 6.3) in Openeuler Lcr, published September 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in lcr 2.0.5-20210518.110612.git5225bddc.oe1.
References
gitee.com/src-openeuler/lcr/pulls/251/files
openeuler.org/en/security/security-bulletins/detail?id=openEuler-SA-2023-1692
nvd.nist.gov/vuln/detail/CVE-2021-33634
github.com/advisories/GHSA-5mrv-f9xf-hpqp