CVE-2022-23648 — Sensitive Information Exposure in Containerd

CWE-200 — Sensitive Information ExposureCWE-552 — Files or Directories Accessible to External Parties14 documents9 sources
Severity
7.5HIGHNVD
EPSS
6.2%
top 9.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
ContainerdGithub.com Containerd ContainerdLinuxfoundation Containerd+2 more
Timeline
PublishedMar 3
Latest updateAug 21

Description

containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitiv…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶NVDlinuxfoundation/containerd1.5.0 — 1.5.10+2
▶CVEListV5containerd/containerd< 1.4.13+2
▶Gogithub.com/containerd_containerd1.5.0 — 1.5.10+2
▶Debiancontainerd/containerd< 1.4.13~ds1-1~deb11u1+3

Also affects: Debian Linux 11.0, Fedora 34, 35, 36

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd↗2024-08-21
▶
CVEList
Insecure handling of image volumes in containerd CRI plugin↗2022-03-03
▶
OSV
CVE-2022-23648: containerd is a container runtime available as a daemon for Linux and Windows↗2022-03-03
▶
OSV
containerd CRI plugin: Insecure handling of image volumes↗2022-03-02
▶
GHSA
containerd CRI plugin: Insecure handling of image volumes↗2022-03-02
▶

📋Vendor Advisories

6
Ubuntu
containerd vulnerabilities↗2022-07-15
▶
Ubuntu
containerd regression↗2022-05-16
▶
Microsoft
Insecure handling of image volumes in containerd CRI plugin↗2022-03-08
▶
Ubuntu
containerd vulnerability↗2022-03-03
▶
Red Hat
containerd: insecure handling of image volumes↗2022-03-02
▶
CVE-2022-23648 — Sensitive Information Exposure | cvebase