Vulnerability · Published Jan 5, 2022 · Assigned by GitHub_M
CVE-2021-43816Improper Preservation of Permissions in containerd
High 8.0
In plain English
A high-severity security flaw in containerd from containerd. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | containerd | 1.5.9-r0 | ALPINE-CVE-2021-43816 |
| Alpine:v3.21 | containerd | 1.5.9-r0 | ALPINE-CVE-2021-43816 |
| Alpine:v3.22 | containerd | 1.5.9-r0 | ALPINE-CVE-2021-43816 |
| Alpine:v3.23 | containerd | 1.5.9-r0 | ALPINE-CVE-2021-43816 |
| Alpine:v3.24 | containerd | 1.5.9-r0 | ALPINE-CVE-2021-43816 |
| Debian:12 | containerd | 1.5.9~ds1-1 | DEBIAN-CVE-2021-43816 |
| Debian:13 | containerd | 1.5.9~ds1-1 | DEBIAN-CVE-2021-43816 |
| Debian:14 | containerd | 1.5.9~ds1-1 | DEBIAN-CVE-2021-43816 |
| Go | github.com/containerd/containerd | 1.5.9 | GHSA-mvff-h3cj-wj9c |
| Go | github.com/containerd/containerd | 1.5.9 | GO-2022-0278 |
| Ubuntu:22.04:LTS | containerd | 1.5.9-0ubuntu1 | UBUNTU-CVE-2021-43816 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| containerd | containerd | >= 1.5.0, < 1.5.9 |
Weakness: CWE-281 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/containerd/containerd/security/advisories/GHSA-mvff-h3cj-wj9c x_refsource_CONFIRM
- https://github.com/containerd/containerd/issues/6194 x_refsource_MISC
- https://github.com/containerd/containerd/commit/a731039238c62be081eb8c31525b988415745eea x_refsource_MISC
- https://github.com/dweomer/containerd/commit/f7f08f0e34fb97392b0d382e58916d6865100299 x_refsource_MISC
- FEDORA-2022-f668c3d70d vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-a0b2a4d594 vendor-advisory, x_refsource_FEDORA