UpHeron
All vulnerabilities

Servers and applications

CVE-2021-43816

containerd CRI plugin: Unprivileged pod using `hostPath` can side-step SELinux

Severity
Critical 9.1
Published
5 Jan 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.5.9
Also known as
GHSA-mvff-h3cj-wj9c
Sources
NVD, Project advisories (GitHub)

Description

containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved…

Affected software

SoftwareAffected versions
containerdServers and applications · cpe:a:linuxfoundation:containerd
  • From 1.5.1 before 1.5.9
  • Version 1.5.0
  • Version 1.5.0-rc3
  • Version 1.5.0-rc2
All 11 release lines
  • Version 1.5.0-beta0
  • Version 1.5.0-beta1
  • Version 1.5.0-beta2
  • Version 1.5.0-beta3
  • Version 1.5.0-beta4
  • Version 1.5.0-rc0
  • Version 1.5.0-rc1
  • Version 1.5.0-rc2
  • Version 1.5.0-rc3
  • Version 1.5.0
  • From 1.5.1 before 1.5.9
containerdServers and applications · github:containerd/containerd
  • From 1.5.0 before 1.5.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-43816
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-43816
  • GitHub Advisory Database https://github.com/advisories/GHSA-mvff-h3cj-wj9c
  • github.com https://github.com/containerd/containerd/security/advisories/GHSA-mvff-h3cj-wj9c