CVE-2021-43816
Improper Preservation of Permissions in containerd
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High8.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.8% · top 21% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.0.
Weakness
Affected products
- affected >= 1.5.0, < 1.5.9
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogithub.com/containerd/containerdGHSA-mvff-h3cj-wj9c (opens in a new tab)
References (6)
- https://github.com/containerd/containerd/security/advisories/GHSA-mvff-h3cj-wj9c (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/containerd/containerd/issues/6194 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/containerd/containerd/commit/a731039238c62be081eb8c31525b988415745eea (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/dweomer/containerd/commit/f7f08f0e34fb97392b0d382e58916d6865100299 (opens in a new tab)x_refsource_MISCx_transferred
- FEDORA-2022-f668c3d70d (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- FEDORA-2022-a0b2a4d594 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-mvff-h3cj-wj9c (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2021-43816)Record last updated .