CVE-2021-43816
Publication date 5 January 2022
Last updated 24 July 2024
Ubuntu priority
containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| containerd | 24.10 oracular |
Fixed 1.5.9-0ubuntu1
|
| 24.04 LTS noble |
Fixed 1.5.9-0ubuntu1
|
|
| 22.04 LTS jammy |
Fixed 1.5.9-0ubuntu1
|
|
| 20.04 LTS focal |
Fixed 1.5.9-0ubuntu1~20.04.4
|
|
| 18.04 LTS bionic |
Fixed 1.5.9-0ubuntu1~18.04.1
|
|
| 16.04 LTS xenial |
Vulnerable
|
|
| 14.04 LTS trusty | Ignored end of standard support |
Notes
alexmurray
This vulnerability is specific to when using containerd with SELinux, whilst SELinux is supported on Ubuntu it is not enabled by default. Hence setting the priority of this CVE to low.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
9.1 · Critical
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | High |
| User interaction | None |
| Scope | Changed |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |