containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.
The CRI (Container Runtime Interface) plugin in containerd rewrites labels defined in the image configuration (LABEL instruction in Dockerfile) directly to the metadata of the running container without validating their correctness or security. If any plugin or component in the environment consumes container labels to perform operations, specially crafted labels embedded in a malicious image can be interpreted as commands to execute. As a result, an attacker controlling the image content can cause arbitrary commands to be executed on the host system.
An attacker can execute arbitrary commands on the host where the container is running (RCE), resulting in complete takeover of the node — compromising the confidentiality, integrity, and availability of both the host system and other containers.
Update containerd to version 1.7.33, 2.0.10, 2.1.9, 2.2.5, or 2.3.2 (depending on the branch in use). Until the update is applied, it is recommended to run only trusted container images from verified sources.
containerd (Linux Foundation) in versions earlier than 1.7.33, 2.0.10, 2.1.9, 2.2.5, and 2.3.2
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XLinuxfoundation Containerd
APPLinuxfoundation1.7.0 – 1.7.33 (excl.)2.0.0 – 2.0.10 (excl.)2.1.0 – 2.1.9 (excl.)2.2.0 – 2.2.5 (excl.)2.3.0 – 2.3.2 (excl.)
Related vulnerabilities
containerd: nieautoryzowane wstrzyknięcie CDI przez metadane checkpoint
containerd: ominięcie runAsNonRoot przez duży numeryczny identyfikator użytkownika
containerd: odczyt dowolnego pliku hosta przez niezwalidowany symlink w checkpoint
containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1...
containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containe...