You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Vulnerable versions: >= 1.5.0, < 1.5.9
Impact:
Containers launched through containerd’s CRI implementation on Linux
systems which use the SELinux security module and containerd versions
since v1.5.0 can cause arbitrary files and directories on the host to
be relabeled to match the container process label through the use of
specially-configured bind mounts in a hostPath volume. This relabeling
elevates permissions for the container, granting full read/write access
over the affected files and directories. Kubernetes and crictl can both
be configured to use containerd’s CRI implementation.
0 commit comments