Vulnerability in containerd: RAPL Accessible to Containers
Summary
GHSA-7ww5-4wqc-m92c: containerd allows RAPL to be accessible to a container. Affects github.com/containerd/containerd across 2 version ranges.
< 1.6.26
>= 1.7.0, < 1.7.11
Fixed in 1.6.26 or 1.7.11, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
containerd is an open-source container runtime that provides a platform-agnostic interface for managing containers. It is written in Go and widely used in container orchestration systems like Kubernetes. The vulnerability in containerd allows unprivileged access to the Running Average Power Limit (RAPL) feature, which provides insights into hardware energy consumption. This vulnerability poses a risk to multi-tenant container environments.
Vulnerability Detail
The RAPL feature, introduced by Intel's Sandy Bridge microarchitecture, is accessed through the powercap framework in the Linux kernel. Unprivileged access to RAPL readings can be exploited as a power-based side-channel attack against security features like AES-NI and KASLR. This vulnerability has been assigned CVE-2020-8694, CVE-2020-8695, and CVE-2020-12912. While mitigations have been applied, they do not cover container-based scenarios where root inside a container has the same privilege level as root outside the container. The default mount configuration and AppArmor profile in containerd are not sufficient to prevent this attack.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.6.261.6.26go get github.com/containerd/containerd@v1.6.26 -
>= 1.7.0, < 1.7.111.7.11go get github.com/containerd/containerd@v1.7.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in containerd that allows unprivileged access to RAPL readings poses a risk to multi-tenant container environments. It is recommended to update containerd to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
containerd is an open-source container runtime that provides a platform-agnostic interface for managing containers. It is widely used in container orchestration systems like Kubernetes.
RAPL (Running Average Power Limit) is a feature introduced by Intel's Sandy Bridge microarchitecture. It provides software insights into hardware energy consumption.
This vulnerability allows unprivileged access to RAPL readings, which can be exploited as a power-based side-channel attack against security features like AES-NI and KASLR. It poses a risk to multi-tenant container environments.
Intel has reduced the sampling resolution via a microcode update, and the Linux kernel prevents access by non-root users since version 5.10. However, these mitigations do not cover container-based scenarios. The recommended mitigation is to update containerd to the latest version.
To update containerd, follow the standard update process for your specific deployment environment. Make sure to update to version 1.6.26 or later for versions 1.6.x, and version 1.7.11 or later for versions 1.7.x.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
