CVE-2022-23648

Katalog CVE

CVSS 7.5 · High EPSS 27,4%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada linuxfoundation containerd, debian linux +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue.

Rincian

Terbit di NVD

3 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

27,4% peluang dieksploitasi; lebih tinggi dari 98,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/containerd/containerd/commit/10f428dac7cec44c864e1b830a4623af27a9fc70 patch · advisory pihak ketiga
• https://github.com/containerd/containerd/releases/tag/v1.4.13 patch · release notes · advisory pihak ketiga
• https://github.com/containerd/containerd/releases/tag/v1.5.10 patch · release notes · advisory pihak ketiga
• https://github.com/containerd/containerd/releases/tag/v1.6.1 patch · release notes · advisory pihak ketiga
• http://packetstormsecurity.com/files/166421/containerd-Image-Volume-Insecure-Handling.html exploit · advisory pihak ketiga · vdb entry
• https://github.com/containerd/containerd/security/advisories/GHSA-crp2-qrr5-8pq7 advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5091 mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUDQUQBZJGBWJ...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFTS2EF3S7HNY...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OCCARJ6FU4MWB...
• https://security.gentoo.org/glsa/202401-31