Skip to content
Fencer Vulns
high 7.5

CVE-2022-24778 json

Incorrect Authorization in imgcrypt

published 2022-03-25 4 y ago modified 2026-06-17 4 mo ago also GHSA-8v99-48m9-c8pm , GO-2021-0412 , EUVD-2022-1386

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images. The imgcrypt function `CheckAuthorization` is supposed to check whether the current used is authorized to access an encrypted image and prevent the user from running an image that another user previously decrypted on the same system. In versions prior to 1.1.4, a failure occurs when an image with a ManifestList is used and the architecture of the local host is not the first one in the ManifestList. Only the first architecture in the list was tested, which may not have its layers available locally since it could not be run on the host architecture. Therefore, the verdict on unavailable layers was that the image could be run anticipating that image run failure would occur later due to the layers not being available. However, this verdict to allow the image to run enabled other architectures in the ManifestList to run an image without providing keys if that image had previously been decrypted. A patch has been applied to imgcrypt 1.1.4. Workarounds may include usage of different namespaces for each remote user.

Patch / fix

  • go github.com/containerd/imgcrypt 1.1.4
  • linuxfoundation imgcrypt 1.1.4
  • containerd Ubuntu 18.04 LTS 1.5.9-0ubuntu1~18.04.2
  • containerd Ubuntu 20.04 LTS 1.5.9-0ubuntu1~20.04.6
  • containerd Ubuntu 22.04 LTS 1.5.9-0ubuntu3.1

ubuntu advisories UBUNTU-CVE-2022-24778

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-24778 updated cvss 7.4

imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path

  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/prometheus-rhel9, rhacm2/rbac-query-proxy-rhel8, endpoint-monitoring-operator-container, rhacm2/multicluster-operators-subscription-rhel8, rhacm2/multicluster-operators-subscription-release-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-scanner-rhel8
    affected: no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/ose-docker-builder, openshift4/ose-hypershift-rhel8, openshift4/special-resource-rhel8-operator, openshift4/ose-openshift-proxy-pull-test-rhel8, openshift4/ose-machine-api-provider-openstack-rhel8, openshift4/ose-vsphere-cloud-controller-manager-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4.11 openshift4/kubernetes-nmstate-rhel8-operator v4.11.0-202208020235.p0.ga6744d1.assembly.stream
    fixed: vendor fix RHSA-2022:5070
  • Red Hat RHACS 3.73 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 3.73.0-4
    fixed: vendor fix RHSA-2022:8827
  • Red Hat OpenShift API for Data Protection oadp/oadp-velero-plugin-rhel8
    not affected: vulnerable code not present
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/multiclusterhub-repo-rhel8, rhacm2/multicluster-operators-channel-rhel9, rhacm2/multicluster-operators-subscription-rhel9
    not affected: component not present
show 1 more
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-grafana, openshift4/ose-tools-rhel9, openshift4/ose-thanos-rhel9, openshift4/ose-prom-label-proxy, openshift4/ose-prometheus-rhel9, +4 more Red Hat OpenShift Container Platform 4.11 openshift4/ose-ptp v4.11.0-202208020235.p0.g8a9f7b8.assembly.stream, openshift4/metallb-rhel8 v4.11.0-202208020235.p0.gb616a1a.assembly.stream, openshift4/ose-sriov-cni v4.11.0-202208020235.p0.g02778b0.assembly.stream, openshift4/ose-descheduler v4.11.0-202208020235.p0.g8271278.assembly.stream, openshift4/ose-ptp-operator v4.11.0-202208020706.p0.g73c849a.assembly.stream, openshift4/ose-contour-rhel8 v4.11.0-202208020235.p0.g45e9b62.assembly.stream, +39 more Red Hat OpenStack Platform 16.2 rhosp-rhel8-tech-preview/osp-director-operator Red Hat RHACS 3.73 for RHEL 8 advanced-cluster-security/rhacs-docs-rhel8 3.73.0-4, advanced-cluster-security/rhacs-roxctl-rhel8 3.73.0-4, advanced-cluster-security/rhacs-scanner-rhel8 3.73.0-4, advanced-cluster-security/rhacs-rhel8-operator 3.73.0-4, advanced-cluster-security/rhacs-collector-rhel8 3.73.0-4, advanced-cluster-security/rhacs-operator-bundle 3.73.0-6, +5 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

2.72% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/containerd/imgcrypt/issues/69 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/containerd/imgcrypt
<1.1.4
1.1.4

Affected products

  • containerd imgcrypt

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.