CVE-2022-23648 Insecure handling of image volumes in containerd CRI plugin
Attackers can read arbitrary host files via crafted container images, bypassing security policies and exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23648?
CVE-2022-23648 is a high-severity vulnerability in Debian Debian Linux, published on 3 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue.
Weakness: CWE-200
Which versions are affected by CVE-2022-23648?
7 open source packages ship an affected version, including github.com/containerd/containerd. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containerd/containerd Go | All versions | 1.4.13, 1.5.10, 1.6.1 |
github.com/containerd/containerd Go | All versions | 1.4.13 |
github.com/containerd/containerd Go | All versions | 1.4.13 |
github.com/containerd/containerd Go | From 1.5.0 | 1.5.10 |
github.com/containerd/containerd Go | From 1.5.0 | 1.5.10 |
github.com/containerd/containerd Go | From 1.6.0 | 1.6.1 |
1 more packages
github.com/containerd/containerd Go | From 1.6.0 | 1.6.1 |
Linux distribution packages (8)
containerd SUSE:Linux Enterprise Micro 5.0 | All versions | 1.4.12-63.1 |
containerd SUSE:Linux Enterprise Micro 5.1 | All versions | 1.4.12-63.1 |
containerd SUSE:Linux Enterprise Micro 5.2 | All versions | 1.4.12-63.1 |
containerd SUSE:Linux Enterprise Module for Containers 12 | All versions | 1.4.13-16.54.1 |
containerd SUSE:Linux Enterprise Module for Containers 15 SP3 | All versions | 1.4.12-63.1 |
containerd openSUSE:Leap 15.3 | All versions | 1.4.12-63.1 |
containerd openSUSE:Tumbleweed | All versions | 1.4.13-1.1 |
trivy openSUSE:Tumbleweed | All versions | 0.26.0-1.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Linuxfoundation Containerd.
How do I fix CVE-2022-23648?
Upgrade github.com/containerd/containerd to a fixed version for your release line: 1.4.13, 1.5.10 or 1.6.1.
Is CVE-2022-23648 being exploited?
There is no known exploitation of CVE-2022-23648 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2025-XK69277, DEBIAN-CVE-2022-23648, DSA-5091-1, GHSA-crp2-qrr5-8pq7, GO-2022-0344, MGASA-2022-0088 and 10 more.