Elevated Privileges Vulnerability in containerd and Docker Packages
Summary
CVE-2020-15257: containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. Affects containerd across 3 version ranges.
< 1.4.3~ds1-1
< 4a4bb851f5da563ff6e68a83dc837c7699c469ad
< 269548fa27e0089a8b8278fc4fc781d7f65a939b
Fixed in 1.4.3~ds1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
containerd is an industry-standard container runtime that serves as a daemon for managing container lifecycles on Linux and Windows systems. It is widely used in various container orchestration platforms, including Kubernetes. The vulnerability in question affects versions of containerd prior to 1.3.9 and 1.4.3, as well as specific versions of Docker that rely on these containerd versions. This vulnerability arises from improper access controls in the containerd-shim API, which can lead to security risks if exploited.
Vulnerability Detail
In containerd versions before 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. The access controls for the shim's API socket only verify that the connecting process has an effective UID of 0, without restricting access to the abstract Unix domain socket. This flaw allows malicious containers running in the same network namespace as the shim, with an effective UID of 0 but reduced privileges, to execute new processes with elevated privileges. This could lead to unauthorized actions and compromise the host system's security.
How To Fix
Minimum fixed version
1.4.3~ds1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade containerdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade immediately, you can implement a workaround by denying access to all abstract sockets using AppArmor. You can add the following line to your AppArmor policy: deny unix addr=@**. This will help mitigate the risk until a proper upgrade can be performed.
Conclusion
The vulnerability identified in containerd and Docker packages poses a significant risk due to improper access controls in the containerd-shim API. Users are strongly advised to upgrade to the latest versions to mitigate this risk. Implementing workarounds can provide temporary relief, but upgrading is the most effective solution.
See every vulnerability recorded for containerd →
FAQ
The CVSS score of this vulnerability is 5.2, indicating a moderate level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without any signup.
If you are unable to upgrade immediately, you can implement a temporary workaround by using AppArmor to deny access to abstract sockets.
Failing to address this vulnerability could allow malicious containers to execute processes with elevated privileges, potentially compromising the host system and other containers.
Running containers with UID 0 in the same network namespace as the shim is not safe. It is best practice to run containers with a reduced set of privileges and a non-zero UID.
Related vulnerabilities
Recent vulnerabilities recorded for containerd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
