Skip to content
OpenAdvisories
High USN-5776-1 4 CVEs

containerd vulnerabilities

Published Dec 13, 2022 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that containerd incorrectly handled memory
when receiving certain faulty Exec or ExecSync commands. A remote
attacker could possibly use this issue to cause a denial of service
or crash containerd. (CVE-2022-23471, CVE-2022-31030)

It was discovered that containerd incorrectly set up inheritable file
capabilities. An attacker could possibly use this issue to escalate
privileges inside a container. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24769)

It was discovered that containerd incorrectly handled access to encrypted
container images when using imgcrypt library. A remote attacker could
possibly use this issue to access encrypted images from other users.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2022-24778)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS containerd 1.5.9-0ubuntu1~18.04.2
Ubuntu · 20.04 LTS 20.04:LTS containerd 1.5.9-0ubuntu1~20.04.6
Ubuntu · 22.04 LTS 22.04:LTS containerd 1.5.9-0ubuntu3.1

Vulnerabilities 4

  • High 7.5
    CVE-2022-24778

    Incorrect Authorization in imgcrypt

    The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images. The imgcrypt function `CheckAuthorization` is suppos…

    containerd imgcrypt containerd github.com/containerd/imgcrypt Ubuntu Go
  • Medium 5.9
    CVE-2022-24769

    Default inheritable capabilities for linux container should be empty

    Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilit…

    moby moby ctop docker-machine-driver-harvester Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.7
    CVE-2022-23471

    containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak

    containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the us…

    containerd containerd ctop containerd Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.5
    CVE-2022-31030

    containerd CRI plugin: Host memory exhaustion through ExecSync

    containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause co…

    containerd containerd ctop containerd Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • report
    https://ubuntu.com/security/CVE-2022-23471
  • report
    https://ubuntu.com/security/CVE-2022-24769
  • report
    https://ubuntu.com/security/CVE-2022-24778
  • report
    https://ubuntu.com/security/CVE-2022-31030