Summary​

Containers launched through containerd's CRI implementation on Linux systems that use the SELinux security module — and containerd versions since v1.5.0 — can cause arbitrary files and directories on the host to be relabeled to match the container process label through the use of specially-configured bind mounts in a hostPath volume. This relabeling elevates permissions for the container, granting full read/write access over the affected files and directories. Kubernetes and crictl can both be configured to use containerd's CRI implementation.

If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not affected by this issue.

Impact​

On SELinux-enforcing nodes, an unprivileged pod with permission to mount a hostPath volume can pick any file on the host (including SELinux-protected paths normally outside the container's reach) and have it relabeled to the container's process label. From that point on, the container has full read/write access to the relabeled file or directory. The labels persist after the pod exits, so a single attacker pod can leave the node permanently weakened from an SELinux perspective.

Detection​

Audit Pod specs across the cluster for hostPath volumes — especially those mounting paths under /etc, /var, /usr, or other SELinux-protected directories. On affected nodes, a post-incident review of restorecon -nv / or equivalent label audits will identify files whose labels no longer match the policy default. Treat any hostPath mount on a containerd CRI cluster running 1.5.0–1.5.8 as untrusted until confirmed.

Mitigation​

Upgrade containerd to 1.5.9 or later.

Workarounds:

• Ensure that no sensitive files or directories are used as a hostPath volume source.
• Apply admission policy (Pod Security Admission restricted, Kyverno, or OPA Gatekeeper) to forbid hostPath volumes outside an allow-list.
• After patching, validate that all files on the host are correctly labeled — file labels persist independently of containerd, so the relabeling damage from a successful exploit must be repaired manually (restorecon).

The analyzer below flags hostPath volumes in any uploaded manifest — useful when reviewing existing workloads against this class of issue.

References​

• GHSA-mvff-h3cj-wj9c — containerd security advisory
• NVD CVE-2021-43816
• Unrestricted hostPath Mounts attack vector
• hostPath Mitigation best practice