CVE-2021-43816: Containerd Unprivileged Pod HostPath Vulnerability
Summary
CVE-2021-43816: Unprivileged pod using hostPath can side-step active LSM when it is SELinux. Affects github.com/containerd/containerd versions >= 1.5.0, < 1.5.9. Fixed in 1.5.9. How to fix ↓
Also tracked for
- containerd · Debian:12
The same CVE-2021-43816 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Containerd is an open-source container runtime that provides a platform-agnostic interface for managing containers. It is widely used in container orchestration systems like Kubernetes. The vulnerability affects containerd versions since v1.5.0 on Linux systems that use the SELinux security module. SELinux is a mandatory access control mechanism that enforces fine-grained access policies on Linux systems. The vulnerability allows an unprivileged pod to bypass SELinux and gain full read/write access to arbitrary files and directories on the host system through specially-configured bind mounts in a hostPath volume. This can lead to unauthorized access and modification of sensitive files and data on the host.
Vulnerability Detail
The vulnerability arises due to a flaw in containerd's CRI implementation when using SELinux. By leveraging the hostPath volume feature, an attacker can mount arbitrary files and directories from the host system into a container. The SELinux relabeling mechanism, which should enforce access controls, can be bypassed, allowing the container to gain elevated permissions and full control over the mounted files and directories. This can lead to data leakage, unauthorized access, and potential compromise of the host system. The vulnerability affects containerd versions since v1.5.0 on Linux systems with SELinux enabled.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.9
This is the first release that contains the fix.
go get github.com/containerd/containerd@v1.5.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To mitigate the risk, it is advised to avoid using sensitive files or directories as a hostPath volume source location. This can be enforced through policy mechanisms like Kubernetes Pod Security Policy, specifically the 'AllowedHostPaths' configuration, which limits the files and directories that can be bind-mounted to containers. By carefully defining the allowed host paths, the attack surface can be reduced and the impact of the vulnerability minimized.
Conclusion
The containerd Unprivileged Pod HostPath Vulnerability (CVE-2021-43816) allows unprivileged pods to bypass SELinux and gain unauthorized access to sensitive files and directories on the host system. It is crucial to update containerd to version 1.5.9 or later and validate file labels to ensure proper access controls. Additionally, implementing policy mechanisms like Kubernetes Pod Security Policy can limit the impact of the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
The vulnerability affects Linux systems that use the SELinux security module and have containerd versions since v1.5.0 installed.
Containerd's CRI (Container Runtime Interface) implementation is a standardized interface for container runtimes in Kubernetes. It allows Kubernetes to interact with containerd as the underlying container runtime.
SELinux (Security-Enhanced Linux) is a mandatory access control mechanism for Linux systems. It provides fine-grained access control policies to enforce security and prevent unauthorized access.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to apply the recommended fixes and security updates to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
