9.1

CVE-2021-43816: containerd Improper Preservation of Permissions

CVSS: 9.1v3.1CriticalModified
AliasesMGASA-2022-0071UBUNTU-CVE-2021-43816DEBIAN-CVE-2021-43816
Published 05-01-2022Last modified 22-04-2025
Open JSON

Vulnerability summary

CVE-2021-43816 is a critical (CVSS 9.1) Improper Preservation of Permissions vulnerability in containerd. EPSS estimates a 1.68% chance of exploitation in the next 30 days, higher than 76.6% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.1/10
010
Critical · v3.1 (NVD)
EPSS score
1.68%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Timeline

  1. 05-01-2022
    PublishedVulnerability first disclosed.
  2. 22-04-2025
    Last modifiedVulnerability information updated.

Description

containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

1.68%

Chance of exploitation in the next 30 days

Percentile

77%

Versus all other CVEs

30-day change

0.00 pp

From 1.68% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.68%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Containerd

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Containerd1 product
Debian1 product
  • containerd< 1.5.9~ds1-1
Fedoraproject1 product
Github.com/containerd1 product
  • containerd≥ 1.5.0, < 1.5.9
Linuxfoundation1 product
  • containerdEOL≥ 1.5.1, < 1.5.9 | 1.5.0 | 1.5.0:beta0 | 1.5.0:beta1 | 1.5.0:beta2 | 1.5.0:beta3 | 1.5.0:beta4 | 1.5.0:rc0 | 1.5.0:rc1 | 1.5.0:rc2 | 1.5.0:rc3
Mageia1 product
  • docker-containerd< 1.5.9-1.mga8
Ubuntu1 product
  • containerdAll versions (No fix recorded) | < 1.5.9-0ubuntu1~18.04.1 | < 1.5.9-0ubuntu1~20.04.4 | < 1.5.9-0ubuntu1

7 vendors · 7 products

References

16 links
Show all 16 references