Sensitive Data Exposure in Containerd: CVE-2022-23648
Summary
CVE-2022-23648: containerd is a container runtime available as a daemon for Linux and Windows. Affects containerd across 4 version ranges.
< 1.4.13~ds1-1~deb11u1
< 2a1d4dbdb2a1030dc5b01e96fb110a9d9f150ecc
< 9cc61520f4cd876b86e77edfeb88fbcd536d1f9d
< 10f428dac7cec44c864e1b830a4623af27a9fc70
Fixed in 1.4.13~ds1-1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Containerd is a widely-used container runtime that operates as a daemon for managing container lifecycles on Linux and Windows systems. It is integral to various container orchestration platforms, including Kubernetes, and is known for its efficiency in handling container images and execution. However, a vulnerability was discovered that allows containers to access sensitive files on the host system, potentially compromising security policies.
Vulnerability Detail
The vulnerability identified as CVE-2022-23648 arises from a flaw in containerd's CRI implementation on Linux. Specifically, it allows containers launched with specially-crafted image configurations to gain unauthorized access to read-only copies of arbitrary files and directories on the host. This could lead to the exposure of sensitive information, bypassing any policy-based enforcement mechanisms, including Kubernetes Pod Security Policies. The issue affects multiple versions of containerd prior to the fixed releases, making it critical for users to update their installations.
How To Fix
Minimum fixed version
1.4.13~ds1-1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade containerdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to sensitive files and directories on the host system or implement stricter security policies within Kubernetes. However, the best course of action is to apply the recommended updates as soon as possible.
Conclusion
CVE-2022-23648 represents a significant security risk for users of containerd, allowing unauthorized access to sensitive host files. It is crucial for users to update to the fixed versions to protect their systems and data. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for containerd →
FAQ
CVE-2022-23648 is a vulnerability in containerd that allows containers to access sensitive files on the host system due to a flaw in its CRI implementation.
Versions of containerd prior to 1.6.1, 1.5.10, and 1.4.12 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The CVSS score of CVE-2022-23648 is 7.5, indicating a high severity level.
If immediate updates are not possible, consider implementing stricter access controls on sensitive files and directories to mitigate potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for containerd.
