CVE-2021-43816 - CVE House
Back to Database
Status published High CVE-2021-43816

Improper Preservation of Permissions in containerd

Vulnerability Description

containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-43816

Credits & Attribution

No credits recorded in the NVD database.

References

More from containerd

View All →
CVE-2025-64329
containerd CRI server: Host memory exhaustion through Attach goroutine leak
Medium 6.9
CVE-2025-47291
containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
Medium 4.6
CVE-2025-47290
Containerd vulnerable to host filesystem access during image unpack
High 7.6
CVE-2024-40635
containerd has an integer overflow in User ID handling
Medium 4.6
CVE-2024-25621
containerd affected by a local privilege escalation via wide permissions on CRI directory
High 7.3

Affected Vendor

Affected Software

containerd
Vulnerable Versions:
>= 1.5.0, < 1.5.9

Timeline

Official Publish: January 5th, 2022
Last Modified: April 22nd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-281

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.