CVE-2021-43816: containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible. Please bump to 1.5.9.
just for the record, stable version does not have this vulnerable code, so 1.4.x is not affected https://github.com/containerd/containerd/commit/d715d009061edf5ed0da5aa81fe7b6d2a6b3c10c
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=59cacb65fb0cceda1dd7e1b742116f35b8987051 commit 59cacb65fb0cceda1dd7e1b742116f35b8987051 Author: Georgy Yakovlev <gyakovlev@gentoo.org> AuthorDate: 2022-01-06 08:15:53 +0000 Commit: Georgy Yakovlev <gyakovlev@gentoo.org> CommitDate: 2022-01-06 08:17:25 +0000 app-containers/containerd: drop 1.5.7 Bug: https://bugs.gentoo.org/830672 Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org> app-containers/containerd/Manifest | 1 - app-containers/containerd/containerd-1.5.7.ebuild | 84 ----------------------- 2 files changed, 85 deletions(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8fdda211404b31c7825bcfcd2f2f139c09c90740 commit 8fdda211404b31c7825bcfcd2f2f139c09c90740 Author: Georgy Yakovlev <gyakovlev@gentoo.org> AuthorDate: 2022-01-06 08:15:20 +0000 Commit: Georgy Yakovlev <gyakovlev@gentoo.org> CommitDate: 2022-01-06 08:17:25 +0000 app-containers/containerd: add 1.5.9 Bug: https://bugs.gentoo.org/830672 Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org> app-containers/containerd/Manifest | 1 + app-containers/containerd/containerd-1.5.9.ebuild | 84 +++++++++++++++++++++++ 2 files changed, 85 insertions(+)
bumpage and cleanup done
(In reply to Georgy Yakovlev from comment #3) > bumpage and cleanup done Thanks, all done!
