935bd589a3
CVE-2021-43816: "Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux" Containers launched through containerd’s CRI implementation on Linux systems which use the SELinux security module and containerd versions since v1.5.0 can cause arbitrary files and directories on the host to be relabeled to match the container process label through the use of specially-configured bind mounts in a hostPath volume. This relabeling elevates permissions for the container, granting full read/write access over the affected files and directories. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. https://github.com/advisories/GHSA-mvff-h3cj-wj9c https://github.com/containerd/containerd/releases/tag/v1.5.9 Signed-off-by: Christian Stewart <christian@paral.in> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
4 lines
199 B
Plaintext
4 lines
199 B
Plaintext
# Computed locally
|
|
sha256 40c9767af3e87f2c36adf2f563f0a8374e80b30bd2b7aa80058c85912406cef4 containerd-1.5.9.tar.gz
|
|
sha256 4bbe3b885e8cd1907ab4cf9a41e862e74e24b5422297a4f2fe524e6a30ada2b4 LICENSE
|