Skip to content
Fencer Vulns
high 7.5

CVE-2022-23648 in the critical feed json

Insecure handling of image volumes in containerd CRI plugin

published 2022-03-02 4 y ago modified 2026-09-10 1 mo ago also GHSA-crp2-qrr5-8pq7 , GO-2022-0344 , EUVD-2022-1411

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
27.4%
EPSS 27.4% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue.

Patch / fix

  • go github.com/containerd/containerd 1.4.13, 1.5.10, 1.6.1
  • linuxfoundation containerd 1.4.13, 1.5.10, 1.6.1
  • containerd Debian 14, Debian 13, Debian 12 1.6.1~ds1-1

debian advisories DEBIAN-CVE-2022-23648

  • containerd Ubuntu 18.04 LTS 1.5.5-0ubuntu3~18.04.2
  • containerd Ubuntu 20.04 LTS 1.5.9-0ubuntu1~20.04.4
  • containerd Ubuntu 22.04 LTS 1.5.9-0ubuntu2

ubuntu advisories UBUNTU-CVE-2022-23648

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +23 more 20.10.14_ce-150000.163.1
  • containerd SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +24 more 1.5.11-150000.68.1
  • docker-kubic openSUSE Leap 15.4, openSUSE Leap 15.3 20.10.14_ce-150000.163.1
  • docker SLE Module for Containers 12 20.10.14_ce-98.80.1
  • containerd SLE Module for Containers 12 1.5.11-16.57.1
  • containerd SLE Module for Containers 15 SP3, SLE Micro 5.2, SLE Micro 5.1 +1 more 1.4.12-63.1
  • containerd SLE Module for Containers 12 1.4.13-16.54.1

suse advisories SUSE-SU-2022:1689-1SUSE-SU-2022:1507-1SUSE-SU-2022:0720-2SUSE-SU-2022:0720-1SUSE-SU-2022:0719-1

  • containerd openSUSE Tumbleweed 1.4.13-1.1
  • trivy openSUSE Tumbleweed 0.26.0-1.1
  • trivy Package Hub 15 SP3, openSUSE Leap 15.3 0.30.4-bp153.8.1
  • trivy Package Hub 15 SP4, openSUSE Leap 15.4 0.28.0-bp154.2.3.1
  • containerd openSUSE Leap 15.3 1.4.12-63.1

opensuse advisories openSUSE-SU-2024:11891-1openSUSE-SU-2024:12008-1openSUSE-SU-2022:10094-1openSUSE-SU-2022:10022-1openSUSE-SU-2022:0720-1

  • containerd Alpine 3.15 1.5.10-r0
  • containerd Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 1.6.1-r0

alpine advisories ALPINE-CVE-2022-23648

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • containerd Arch Linux 1.6.1-1

arch linux advisories AVG-2725

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23648 updated cvss 7.4

containerd: insecure handling of image volumes

  • Red Hat OpenStack Platform 16.2 osp-director-provisioner-container, rhosp-rhel8-tech-preview/osp-director-operator, rhosp-rhel8-tech-preview/osp-director-downloader
    affected: no fix available “Fix deferred”
  • Red Hat Advanced Cluster Management for Kubernetes 2 containerd, rhacm2/prometheus-rhel8, multicluster-hub-repo-container, multicloud-operators-channel-container, multicloud-operators-subscription-container, multicloud-operators-subscription-release-container Red Hat OpenShift Container Platform 4 cri-o, openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, openshift-kube-apiserver, +3 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

27.39% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • packetstormsecurity.com http://packetstormsecurity.com/files/166421/containerd-Image-Volume-Insecure-Handling.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/containerd/containerd
<1.4.13
>=1.5.0, <1.5.10
>=1.6.0, <1.6.1
1.4.13
1.5.10
1.6.1

Affected products

  • containerd containerd

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.