CVE-2022-23648

2022-03-0200:00:00

ubuntu.com

containerd

cri

host access

security bypass

kubernetes

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.007

Percentile

80.1%

JSON

containerd is a container runtime available as a daemon for Linux and
Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and
1.14.12 where containers launched through containerd’s CRI implementation
on Linux with a specially-crafted image configuration could gain access to
read-only copies of arbitrary files and directories on the host. This may
bypass any policy-based enforcement on container setup (including a
Kubernetes Pod Security Policy) and expose potentially sensitive
information. Kubernetes and crictl can both be configured to use
containerd’s CRI implementation. This bug has been fixed in containerd
1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve
the issue.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/containerd/+bug/1973054>

Notes

Author	Note
mdeslaur	While this was fixed in USN-5311-1, a subsequent SRU regressed the security update.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchcontainerd< 1.5.5-0ubuntu3~18.04.2UNKNOWN
ubuntu20.04noarchcontainerd< 1.5.9-0ubuntu1~20.04.4UNKNOWN
ubuntu21.10noarchcontainerd< 1.5.9-0ubuntu1~21.10.3UNKNOWN
ubuntu22.04noarchcontainerd< 1.5.9-0ubuntu2UNKNOWN
ubuntu16.04noarchcontainerd< 1.2.6-0ubuntu1~16.04.6+esm1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	containerd	< 1.5.5-0ubuntu3~18.04.2	UNKNOWN
ubuntu	20.04	noarch	containerd	< 1.5.9-0ubuntu1~20.04.4	UNKNOWN
ubuntu	21.10	noarch	containerd	< 1.5.9-0ubuntu1~21.10.3	UNKNOWN
ubuntu	22.04	noarch	containerd	< 1.5.9-0ubuntu2	UNKNOWN
ubuntu	16.04	noarch	containerd	< 1.2.6-0ubuntu1~16.04.6+esm1	UNKNOWN