CVE catalog
CVE-2021-43816
containerd: CVE-2021-43816
- Severity
- High · CVSS 8
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.68% · Oct 25, 2026
containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | containerd | sid | 2.1.9+ds1-5 | fixed |
| Debian | containerd | forky | 2.1.9+ds1-5 | fixed |
| Debian | containerd | trixie | 1.7.24~ds1-6+deb13u1 | fixed |
| Debian | containerd | trixie-security | 1.7.24~ds1-6+deb13u1 | fixed |
| Debian | containerd | bookworm | 1.6.20~ds1-1+deb12u3 | fixed |
| Debian | containerd | bookworm-security | 1.6.20~ds1-1+deb12u2 | fixed |
| Ubuntu | containerd | pro | 0.2.1-0ubuntu4~16.04 | vulnerable |
| Ubuntu | containerd | pro | 0.2.3-0ubuntu1~16.04 | vulnerable |
| Ubuntu | containerd | pro | 0.2.5-0ubuntu1~16.04.1 | vulnerable |
| Ubuntu | containerd | pro | 1.2.6-0ubuntu1~16.04.2 | vulnerable |
| Ubuntu | containerd | pro | 1.2.6-0ubuntu1~16.04.3 | vulnerable |
| Ubuntu | containerd | pro | 1.2.6-0ubuntu1~16.04.4 | vulnerable |
| Ubuntu | containerd | pro | 1.2.6-0ubuntu1~16.04.5 | vulnerable |
| Ubuntu | containerd | pro | 1.2.6-0ubuntu1~16.04.6 | vulnerable |
| Ubuntu | containerd | pro | 1.2.6-0ubuntu1~16.04.6+esm1 | vulnerable |
| Ubuntu | containerd | pro | 1.2.6-0ubuntu1~16.04.6+esm2 | vulnerable |
| Ubuntu | containerd | pro | 1.2.6-0ubuntu1~16.04.6+esm4 | vulnerable |
| Ubuntu | containerd | pro | 1.2.6-0ubuntu1~16.04.6+esm5 | vulnerable |
| Ubuntu | containerd | pro | 1.2.6-0ubuntu1~16.04.6+esm6 | vulnerable |
| Ubuntu | containerd | pro | 1.2.6-0ubuntu1~16.04.6+esm7 | vulnerable |
| Ubuntu | containerd | 18.04 | 0.2.5-0ubuntu2 | vulnerable |
| Ubuntu | containerd | 18.04 | 1.2.6-0ubuntu1~18.04.1 | vulnerable |
| Ubuntu | containerd | 18.04 | 1.2.6-0ubuntu1~18.04.2 | vulnerable |
| Ubuntu | containerd | 18.04 | 1.3.3-0ubuntu1~18.04.1 | vulnerable |
| Ubuntu | containerd | 18.04 | 1.3.3-0ubuntu1~18.04.2 | vulnerable |
| Ubuntu | containerd | 18.04 | 1.3.3-0ubuntu1~18.04.3 | vulnerable |
| Ubuntu | containerd | 18.04 | 1.3.3-0ubuntu1~18.04.4 | vulnerable |
| Ubuntu | containerd | 18.04 | 1.4.4-0ubuntu1~18.04.2 | vulnerable |
| Ubuntu | containerd | 18.04 | 1.5.2-0ubuntu1~18.04.1 | vulnerable |
| Ubuntu | containerd | 18.04 | 1.5.2-0ubuntu1~18.04.2 | vulnerable |
| Ubuntu | containerd | 18.04 | 1.5.2-0ubuntu1~18.04.3 | vulnerable |
| Ubuntu | containerd | 18.04 | 1.5.5-0ubuntu3~18.04.1 | vulnerable |
| Ubuntu | containerd | 18.04 | 1.5.5-0ubuntu3~18.04.2 | vulnerable |
| Ubuntu | containerd | 18.04 | 1.5.9-0ubuntu1~18.04.1 | fixed |
| Ubuntu | containerd | 20.04 | 1.2.10-0ubuntu1 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.3.2-0ubuntu1 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.3.3-0ubuntu1 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.3.3-0ubuntu2 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.3.3-0ubuntu2.1 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.3.3-0ubuntu2.2 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.3.3-0ubuntu2.3 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.4.4-0ubuntu1~20.04.2 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.5.2-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.5.2-0ubuntu1~20.04.2 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.5.2-0ubuntu1~20.04.3 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.5.5-0ubuntu3~20.04.1 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.5.5-0ubuntu3~20.04.2 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.5.9-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | containerd | 20.04 | 1.5.9-0ubuntu1~20.04.4 | fixed |
| Ubuntu | containerd | 22.04 | 1.5.5-0ubuntu3 | vulnerable |
| Ubuntu | containerd | 22.04 | 1.5.9-0ubuntu1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | containerd | source | sid | 1.5.9~ds1-1 | not yet assigned | Not reported | Not reported |
| Debian | containerd | source | forky | 1.5.9~ds1-1 | not yet assigned | Not reported | Not reported |
| Debian | containerd | source | trixie | 1.5.9~ds1-1 | not yet assigned | Not reported | Not reported |
| Debian | containerd | source | bookworm | 1.5.9~ds1-1 | not yet assigned | Not reported | Not reported |
| Ubuntu | containerd | deb | 18.04 | 1.5.9-0ubuntu1~18.04.1 | Not reported | UBUNTU-CVE-2021-43816 | Not reported |
| Ubuntu | containerd | deb | 20.04 | 1.5.9-0ubuntu1~20.04.4 | Not reported | UBUNTU-CVE-2021-43816 | Not reported |
| Ubuntu | containerd | deb | 22.04 | 1.5.9-0ubuntu1 | Not reported | UBUNTU-CVE-2021-43816 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [containerd]Unknown
Details (4)
1.6.20~ds1-1+deb12u3· amd64 · bookwormFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
1.6.20~ds1-1+deb12u3· arm64 · bookwormFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
1.6.20~ds1-1+deb12u2· amd64 · bookworm-securityFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
1.6.20~ds1-1+deb12u2· arm64 · bookworm-securityFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
Source package: [containerd]
Details (4)
1.6.20~ds1-1+deb12u3· all · bookwormFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
1.6.20~ds1-1+deb12u3· all · bookwormFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
1.6.20~ds1-1+deb12u2· all · bookworm-securityFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
1.6.20~ds1-1+deb12u2· all · bookworm-securityFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
[Debian 13 (Trixie)]
- [containerd]Unknown
Details (4)
1.7.24~ds1-6+deb13u1· amd64 · trixieFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · 13
1.7.24~ds1-6+deb13u1· arm64 · trixieFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · 13
1.7.24~ds1-6+deb13u1· amd64 · trixie-securityFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · 13
1.7.24~ds1-6+deb13u1· arm64 · trixie-securityFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · 13
Source package: [containerd]
Details (4)
1.7.24~ds1-6+deb13u1· all · trixieFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · 13
1.7.24~ds1-6+deb13u1· all · trixieFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · 13
1.7.24~ds1-6+deb13u1· all · trixie-securityFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · 13
1.7.24~ds1-6+deb13u1· all · trixie-securityFixed · Fixed:
1.5.9~ds1-1dsa · containerd · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2021-43816]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2021-43816]
- [https://security-tracker.debian.org/tracker/CVE-2021-43816]
- [https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-43816.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0235.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]