Versio.io

CVE-2021-43816

Common vulnerabilities & exposures (CVE)

CVE databaseCVE database blogpostRelease & EoL database
 
Published at: - 05-01-2022 08:15
Last modified: - 01-04-2022 04:50
Total changes: - 4

Description

containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Low
Attack complexity
Network
Attack vector
High
Availability
High
Confidentiality
High
Integrity
High
Privileges required
Changed
Scope
None
User interaction
9.1
Base score
2.3
6.0
Exploitability score
Impact score
 

Verification logic

OR
OR
vendor=linuxfoundation AND product=containerd AND version=1.5.0 AND update=-
vendor=linuxfoundation AND product=containerd AND version=1.5.0 AND update=beta0
vendor=linuxfoundation AND product=containerd AND version=1.5.0 AND update=beta1
vendor=linuxfoundation AND product=containerd AND version=1.5.0 AND update=beta2
vendor=linuxfoundation AND product=containerd AND version=1.5.0 AND update=beta3
vendor=linuxfoundation AND product=containerd AND version=1.5.0 AND update=beta4
vendor=linuxfoundation AND product=containerd AND version=1.5.0 AND update=rc0
vendor=linuxfoundation AND product=containerd AND version=1.5.0 AND update=rc1
vendor=linuxfoundation AND product=containerd AND version=1.5.0 AND update=rc2
vendor=linuxfoundation AND product=containerd AND version=1.5.0 AND update=rc3
vendor=linuxfoundation AND product=containerd AND versionStartIncluding=1.5.1 AND versionEndExcluding=1.5.9
OR
vendor=fedoraproject AND product=fedora AND version=34
vendor=fedoraproject AND product=fedora AND version=35
 

Reference

 


Keywords

NVD

 

CVE-2021-43816

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures

 

We use cookies to ensure that we give you the best experience on our website. Read privacy policies for more information.