CVE-2021-43816highCWE-281

CVE-2021-43816: high-severity vulnerability in containerd

Improper Preservation of Permissions in containerd

Published · Updated

Follow this CVE+ Monitor containerd+ Monitor containerd

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8epss 1.8%
containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
containerd · containerd
Related CVEs — containerd

In the same product, most dangerous first.

CVE-2022-23648HIGHInsecure handling of image volumes in containerd CRI pluginEPSS 27.4%CVE-2020-15257MEDIUMcontainerd-shim API Exposed to Host Network ContainersEPSS 3.1%CVE-2020-15157MEDIUMcontainerd can be coerced into leaking credentials during image pullEPSS 2.3%CVE-2021-21334MEDIUMenvironment variable leakEPSS 1.9%CVE-2021-32760MEDIUMArchive package allows chmod of file outside of unpack target directoryEPSS 1.6%CVE-2022-23471MEDIUMcontainerd CRI stream server: Host memory exhaustion through terminal resize goroutine leakEPSS 1.1%