GHSA-mvff-h3cj-wj9c CVE-2021-43816 GO-2022-0278
Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux
- Severity
- 8.0 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.81%
- Chance of exploitation in the next 30 days. Higher than 78.61% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-281 Improper Preservation of Permissions
- Fix
1.5.9- Upgrade github.com/containerd/containerd to this version or later
Description
Impact
Containers launched through containerd’s CRI implementation on Linux systems which use the SELinux security module and containerd versions since v1.5.0 can cause arbitrary files and directories on the host to be relabeled to match the container process label through the use of specially-configured bind mounts in a hostPath volume. This relabeling elevates permissions for the container, granting full read/write access over the affected files and directories. Kubernetes and crictl can both be configured to use containerd’s CRI implementation.
If you are not using containerd’s CRI implementation (through one of the mechanisms described above), you are not affected by this issue.
Patches
This bug has been fixed in containerd 1.5.9. Because file labels persist independently of containerd, users should both update to these versions as soon as they are released and validate that all files on their host are correctly labeled.
Workarounds
Ensure that no sensitive files or directories are used as a hostPath volume source location. Policy enforcement mechanisms such a Kubernetes Pod Security Policy AllowedHostPaths may be specified to limit the files and directories that can be bind-mounted to containers.
For more information
If you have any questions or comments about this advisory:
- Open an issue in containerd
- Email us at security@containerd.io
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/containerd/containerd | >= 1.5.0, < 1.5.9 |
1.5.9 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/containerd/containerd Go → 1.5.9
- go
go get github.com/containerd/containerd@v1.5.9 && go mod tidy
Severity breakdown
CVSS 3.1 8.0
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- High
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-281: Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
References
Advisories
Packages
Other links
- github.com/containerd/containerd/security/advisories/GHSA-mvff-h3cj-wj9c
- github.com/containerd/containerd/issues/6194
- github.com/containerd/containerd/commit/a731039238c62be081eb8c31525b988415745eea
- github.com/dweomer/containerd/commit/f7f08f0e34fb97392b0d382e58916d6865100299
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD5GH…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MPDIZ…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rp3h-jf77-q9p4 containerd: Unpack DoS via repeated opaque whiteouts | Medium | Also affects github.com/containerd/containerd |
| GO-2026-6791 containerd CRI plugin: Checkpoint restore bypasses destination security context | High | Also affects github.com/containerd/containerd |
| GHSA-pg57-6jwg-q645 Containerd has image-pull DoS via crafted OCI index graph amplification | Medium | Also affects github.com/containerd/containerd |
| GHSA-7jxh-36q5-gcqv containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service | Medium | Also affects github.com/containerd/containerd |
| GO-2026-5064 containerd CRI checkpoint restore CDI annotation smuggling | Critical | Also affects github.com/containerd/containerd |
| GO-2026-5622 Arbitrary host CRI log file read via symlink following in CRI checkpoint restore | Medium | Also affects github.com/containerd/containerd |
| GHSA-xhf5-7wjv-pqxp containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull | High | Also affects github.com/containerd/containerd |
| GO-2026-5338 containerd: CRI checkpoint import allows local image tag poisoning | Critical | Also affects github.com/containerd/containerd |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor