CVE-2023-25173: containerd Improper Supplementary Group Handling Vulnerability
Summary
CVE-2023-25173: containerd is an open source container runtime. Affects containerd across 4 version ranges.
< 1.4.13~ds1-1~deb11u4
< 39bb06f98f17c7a226b10269d325c861585b2389
< 133f6bb6cd827ce35a5fb279c1ead12b9d21460a
< 2456e983eb9e37e47538f59ea18f2043c9a73640
Fixed in 1.4.13~ds1-1~deb11u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
containerd is an open-source container runtime that manages the complete container lifecycle, including image transfer, container execution, and supervision. It is widely used in various container orchestration platforms, such as Kubernetes, due to its efficiency and performance. However, a vulnerability was discovered in versions prior to 1.6.18 and 1.5.18, which affects how supplementary groups are configured within containers.
Vulnerability Detail
A bug in containerd allows improper setup of supplementary groups inside a container. If an attacker gains direct access to a container and manipulates supplementary group access, they may bypass primary group restrictions. This could lead to unauthorized access to sensitive information or the ability to execute arbitrary code within the container. The vulnerability is particularly concerning for downstream applications utilizing the containerd client library, which may also be affected.
How To Fix
Minimum fixed version
1.4.13~ds1-1~deb11u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade containerdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'USER $USERNAME' instruction in your Dockerfile. Instead, set the container entrypoint to a command that allows proper setup of supplementary groups, such as:
ENTRYPOINT ["su", "-", "user"]
Conclusion
CVE-2023-25173 represents a significant vulnerability in containerd that could allow attackers to bypass security restrictions within containers. Users are strongly advised to update to the latest versions and follow the recommended steps to mitigate potential risks. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for containerd →
FAQ
CVE-2023-25173 is a vulnerability in containerd that allows improper handling of supplementary groups, potentially leading to unauthorized access within containers.
Versions of containerd prior to 1.6.18 and 1.5.18 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Without requiring access to the code or installation, you can check your application using the manifest file like package-lock.json.
If you cannot update immediately, implement the recommended workaround by adjusting your Dockerfile to use 'ENTRYPOINT ["su", "-", "user"]' instead of 'USER $USERNAME'.
The CVSS score for CVE-2023-25173 is 7.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for containerd.
