x/vulndb: potential Go vuln in github.com/containerd/containerd: CVE-2021-43816

[GoVulnBot]

In CVE-2021-43816, the reference URL github.com/containerd/containerd (and possibly others) refers to something in Go.

• Commit: dweomer/containerd@f7f08f0

module: github.com/containerd/containerd
package: containerd
description: |
    containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.
cves:
  - CVE-2021-43816
links:
    commit: https://github.com/dweomer/containerd/commit/f7f08f0e34fb97392b0d382e58916d6865100299
    context:
      - https://github.com/containerd/containerd/issues/6194
      - https://github.com/containerd/containerd/security/advisories/GHSA-mvff-h3cj-wj9c

See doc/triage.md for instructions on how to triage this report.

[neild]

Vulnerability in tool. Fix is in publicly exportable packages, but these packages are effectively internal and have no external uses known to pkg.go.dev.

[gopherbot]

Change https://go.dev/cl/592766 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607215 mentions this issue: data/reports: unexclude 20 reports (13)