CVE-2021-43816: Improper Preservation of Permissions in containerd
An incorrect permission assignment flaw was found in containerd. This flaw allows a local attacker to use a specially designed text file to read and write files outside of the container's scope.
Other sources
containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either /etc/hosts, /etc/hostname, or /etc/resolv.conf. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-43816?
CVE-2021-43816 is an incorrect permission assignment flaw found in containerd, a container runtime.
What is the severity of CVE-2021-43816?
CVE-2021-43816 has a severity rating of 9.1 (Critical).
How does CVE-2021-43816 affect containerd?
CVE-2021-43816 allows a local attacker to bind mount an unprivileged pod to the node via the hostPath volume on installations using SELinux with containerd as the backing container runtime interface (CRI).
Which versions of containerd are affected by CVE-2021-43816?
Containerd versions 1.5.0-beta0 to 1.5.9 are affected by CVE-2021-43816.
How can I fix CVE-2021-43816?
To fix CVE-2021-43816, update containerd to version 1.5.9.