UpHeron
All vulnerabilities

Servers and applications

CVE-2022-23648

containerd CRI plugin: Insecure handling of image volumes

Severity
High 7.5
Published
2 Mar 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.4.13, 1.5.10, 1.6.1
Also known as
GHSA-crp2-qrr5-8pq7
Sources
NVD, Project advisories (GitHub)

Description

containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based…

Affected software

SoftwareAffected versions
containerdServers and applications · cpe:a:linuxfoundation:containerd
  • Every version before 1.4.13
  • From 1.5.0 before 1.5.10
  • From 1.6.0 before 1.6.1
containerdServers and applications · github:containerd/containerd
  • Version 1.6.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-23648
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-23648
  • GitHub Advisory Database https://github.com/advisories/GHSA-crp2-qrr5-8pq7
  • github.com https://github.com/containerd/containerd/security/advisories/GHSA-crp2-qrr5-8pq7