Privilege Escalation Vulnerability in Containerd: SELinux Misconfiguration
Summary
CVE-2021-43816: containerd is an open source container runtime. Affects containerd across 3 version ranges.
< 1.5.9~ds1-1
< a731039238c62be081eb8c31525b988415745eea
< f7f08f0e34fb97392b0d382e58916d6865100299
Fixed in 1.5.9~ds1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Containerd is an open-source container runtime that manages the complete container lifecycle, including image transfer, storage, and execution. It is widely used in various Linux distributions, such as CentOS, RHEL, and Fedora. The vulnerability in question affects installations using SELinux, which is a security mechanism that enforces access control policies. This vulnerability allows unprivileged pods to gain unauthorized access to privileged host files, posing significant security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2021-43816, arises from the improper handling of hostPath volume mounts in containerd versions starting from v1.5.0-beta.0. When a pod is scheduled on a node, it can bind mount privileged files located at /etc/hosts, /etc/hostname, or /etc/resolv.conf. This misconfiguration leads to the relabeling of these files to match the container process label, allowing unprivileged containers to read and write to sensitive host files without proper authorization. The ramifications include potential data breaches and unauthorized modifications to critical system files.
How To Fix
Minimum fixed version
1.5.9~ds1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade containerdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using hostPath volumes for sensitive files or restrict the use of unprivileged pods in environments where SELinux is enforced. Additionally, consider implementing stricter security policies to limit the capabilities of containers.
Conclusion
CVE-2021-43816 is a critical vulnerability in containerd that allows unprivileged pods to gain unauthorized access to sensitive host files due to improper handling of SELinux policies. Users are strongly advised to upgrade to version 1.5.9 or later to mitigate this risk and ensure the security of their containerized environments.
See every vulnerability recorded for containerd →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
Containerd versions from 1.5.0-beta.0 up to 1.5.8 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The potential risks include unauthorized access to sensitive host files, data breaches, and the ability for unprivileged containers to modify critical system configurations.
Yes, the permanent fix is to upgrade to containerd version 1.5.9 or later, which resolves the issue.
Related vulnerabilities
Recent vulnerabilities recorded for containerd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
