CVE-2022-24778: Incorrect Authorization in imgcrypt
Summary
CVE-2022-24778: Incorrect authorization in github.com/containerd/imgcrypt. Affects github.com/containerd/imgcrypt versions < 1.1.4. Fixed in 1.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Imgcrypt is a Go package that implements a function called CheckAuthorization() to verify if a user is authorized to access an encrypted image. This function is used to prevent unauthorized access to decrypted image layers that may be cached locally. However, a vulnerability exists in versions prior to v1.1.4, where the authorization check fails when using an image with a ManifestList and the local host architecture is not the first one in the list. This allows other architectures in the ManifestList to run the image without providing the necessary decryption keys. The CheckAuthorization() function is also used in the ctr-enc client tool provided by imgcrypt. It's important to note that the vulnerability can be circumvented by modifying the client tool to not call this function. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
Vulnerability Detail
The vulnerability in imgcrypt arises from the incorrect authorization check performed by the CheckAuthorization() function. When using an image with a ManifestList, if the local host architecture is not the first one in the list, the authorization check only tests the first architecture, which may not have its layers available locally. As a result, the image is allowed to run, even if it has been previously decrypted by another user. This can lead to unauthorized access to decrypted image layers. The vulnerability affects imgcrypt versions prior to v1.1.4 and can be exploited by using the ctr-enc client tool or a modified client tool that bypasses the authorization check.
How To Fix
Minimum fixed version
1.1.4
This is the first release that contains the fix.
go get github.com/containerd/imgcrypt@v1.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating imgcrypt is not immediately feasible, a possible workaround is to use different namespaces for each remote user. By isolating each user in a separate namespace, the risk of unauthorized access to decrypted image layers can be mitigated. However, this workaround may introduce additional complexity and management overhead.
Conclusion
The vulnerability in imgcrypt allows unauthorized users to access decrypted image layers, potentially leading to the exposure of sensitive information or compromise of the system's integrity. It is crucial to update imgcrypt to version 1.1.4 or later to fix the vulnerability. Alternatively, using separate namespaces for each remote user can provide a temporary workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containerd/imgcrypt →
FAQ
The vulnerability allows unauthorized users to access decrypted image layers, potentially exposing sensitive information or compromising the integrity of the system.
Versions prior to v1.1.4 are affected by this vulnerability.
No, the vulnerability requires local access to the system and the ability to run images using the ctr-enc client tool or a modified client tool.
There is no known public exploit for this vulnerability at the time of this advisory.
Updating imgcrypt to version 1.1.4 or later is the recommended mitigation. Using separate namespaces for each remote user can also help mitigate the risk of unauthorized access to decrypted image layers.
