CVE-2021-43816

containerd is an open source container runtime. On installations using
SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with
containerd since v1.5.0-beta.0 as the backing container runtime interface
(CRI), an unprivileged pod scheduled to the node may bind mount, via
hostPath volume, any privileged, regular file on disk for complete
read/write access (sans delete). Such is achieved by placing the
in-container location of the hostPath volume mount at either /etc/hosts,
/etc/hostname, or /etc/resolv.conf. These locations are being relabeled
indiscriminately to match the container process-label which effectively
elevates permissions for savvy containers that would not normally be able
to access privileged host files. This issue has been resolved in version
1.5.9. Users are advised to upgrade as soon as possible.

Bugs

• <https://github.com/containerd/containerd/issues/6194&gt;

Notes