CVE-2023-25173: Privilege escalation via supplementary groups in github.com/containerd/containerd
Summary
CVE-2023-25173: Privilege escalation via supplementary groups in github.com/containerd/containerd. Affects github.com/containerd/containerd across 2 version ranges.
< 1.5.18
>= 1.6.0, < 1.6.18
Fixed in 1.5.18 or 1.6.18, depending on the release line you run. How to fix ↓
Also tracked for
- containerd · Debian:11
The same CVE-2023-25173 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/containerd/containerd is a Go package that provides a container runtime for Linux. It is widely used in container orchestration systems and provides functionality for managing containers, images, and namespaces. This package is vulnerable to a privilege escalation issue related to the improper setup of supplementary groups inside a container.
Vulnerability Detail
Supplementary groups are not properly configured within a container, allowing an attacker with direct access to the container to manipulate their supplementary group access. By doing so, the attacker may bypass primary group restrictions and potentially escalate privileges within the container. This vulnerability also affects the containerd client library, which may have improperly set up supplementary groups. The vulnerability was introduced in version 1.6.0 of github.com/containerd/containerd and was fixed in version 1.6.18. It was also present in versions prior to 1.5.18.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.5.181.5.18go get github.com/containerd/containerd@v1.5.18 -
>= 1.6.0, < 1.6.181.6.18go get github.com/containerd/containerd@v1.6.18
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above.
Conclusion
The vulnerability in github.com/containerd/containerd allows for privilege escalation within containers. Users should update to the fixed versions mentioned above to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
github.com/containerd/containerd is a Go package that provides a container runtime for Linux. It is widely used in container orchestration systems.
This vulnerability allows an attacker with direct access to a container to potentially escalate privileges within the container.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file and Vulert will analyze it for vulnerabilities.
There are no known workarounds for this vulnerability. It is recommended to apply the fix mentioned above.
To update github.com/containerd/containerd to the fixed version, you can use your package manager or update the package manually by following the instructions provided by the package maintainers.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
