UpHeron
All vulnerabilities

Servers and applications

CVE-2023-25173

Supplementary groups are not set up properly

Severity
High 7.8
Published
16 Feb 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.5.18, 1.6.18
Also known as
GHSA-hmfx-3pcx-653p
Sources
NVD, Project advisories (GitHub)

Description

containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially…

Affected software

SoftwareAffected versions
containerdServers and applications · cpe:a:linuxfoundation:containerd
  • Every version before 1.5.18
  • From 1.6.0 before 1.6.18
containerdServers and applications · github:containerd/containerd
  • From 1.6.0 before 1.6.18

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-25173
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-25173
  • GitHub Advisory Database https://github.com/advisories/GHSA-hmfx-3pcx-653p
  • github.com https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p