CVE catalog

CVE-2022-23648

containerd: CVE-2022-23648

[CVE catalog]

Severity
High · CVSS 7.4CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
27.39% · Oct 25, 2026

containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancontainerdsid2.1.9+ds1-5fixed
Debiancontainerdforky2.1.9+ds1-5fixed
Debiancontainerdtrixie1.7.24~ds1-6+deb13u1fixed
Debiancontainerdtrixie-security1.7.24~ds1-6+deb13u1fixed
Debiancontainerdbookworm1.6.20~ds1-1+deb12u3fixed
Debiancontainerdbookworm-security1.6.20~ds1-1+deb12u2fixed
Ubuntucontainerd18.040.2.5-0ubuntu2vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.3vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.4vulnerable
Ubuntucontainerd18.041.4.4-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.3vulnerable
Ubuntucontainerd18.041.5.5-0ubuntu3~18.04.1vulnerable
Ubuntucontainerd18.041.5.5-0ubuntu3~18.04.2fixed
Ubuntucontainerd20.041.2.10-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.2-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.3vulnerable
Ubuntucontainerd20.041.4.4-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.3vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.1vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.2vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.4fixed
Ubuntucontainerd22.041.5.5-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu1vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu2fixed
Ubuntucontainerd18.040.2.5-0ubuntu2vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.3vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.4vulnerable
Ubuntucontainerd18.041.4.4-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.3vulnerable
Ubuntucontainerd18.041.5.5-0ubuntu3~18.04.1vulnerable
Ubuntucontainerd18.041.5.5-0ubuntu3~18.04.2fixed
Ubuntucontainerd20.041.2.10-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.2-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.3vulnerable
Ubuntucontainerd20.041.4.4-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.3vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.1vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.2fixed
Ubuntucontainerd20.041.2.10-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.2-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.3vulnerable
Ubuntucontainerd20.041.4.4-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.3vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.1vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.2vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.4fixed
Susecontainerdlinux enterprise module for containers 121.4.13-16.54.1fixed
Susecontainerdlinux enterprise micro 5.21.4.12-63.1fixed
Opensusecontainerdtumbleweed1.4.13-1.1fixed
Opensusetrivytumbleweed0.26.0-1.1fixed
Susecontainerdlinux enterprise module for containers 15 sp31.4.12-63.1fixed
Susecontainerdlinux enterprise micro 5.01.4.12-63.1fixed
Susecontainerdlinux enterprise micro 5.11.4.12-63.1fixed
Susetrivypackage hub 15 sp40.28.0-bp154.2.3.1fixed
Opensusetrivyleap 15.40.28.0-bp154.2.3.1fixed
Opensusecontainerdleap 15.31.4.12-63.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancontainerdsourcesid1.6.1~ds1-1not yet assignedNot reportedNot reported
Debiancontainerdsourceforky1.6.1~ds1-1not yet assignedNot reportedNot reported
Debiancontainerdsourcetrixie1.6.1~ds1-1not yet assignedNot reportedNot reported
Debiancontainerdsourcebookworm1.6.1~ds1-1not yet assignedNot reportedNot reported
Ubuntucontainerddeb18.041.5.5-0ubuntu3~18.04.2Not reportedUBUNTU-CVE-2022-23648Not reported
Ubuntucontainerddeb20.041.5.9-0ubuntu1~20.04.4Not reportedUBUNTU-CVE-2022-23648Not reported
Ubuntucontainerddeb22.041.5.9-0ubuntu2Not reportedUBUNTU-CVE-2022-23648Not reported
Ubuntucontainerddeb18.041.5.5-0ubuntu3~18.04.2Not reportedUSN-5311-1Not reported
Ubuntucontainerddeb20.041.5.5-0ubuntu3~20.04.2Not reportedUSN-5311-1Not reported
Ubuntucontainerddeb20.041.5.9-0ubuntu1~20.04.4Not reportedUSN-5311-2Not reported
Susecontainerdrpmlinux enterprise module for containers 121.4.13-16.54.1Not reportedSUSE-SU-2022:0719-1Not reported
Susecontainerdrpmlinux enterprise micro 5.21.4.12-63.1Not reportedSUSE-SU-2022:0720-2Not reported
Opensusecontainerdrpmtumbleweed1.4.13-1.1Not reportedOPENSUSE-SU-2024:11891-1Not reported
Opensusetrivyrpmtumbleweed0.26.0-1.1Not reportedOPENSUSE-SU-2024:12008-1Not reported
Susecontainerdrpmlinux enterprise module for containers 15 sp31.4.12-63.1Not reportedSUSE-SU-2022:0720-1Not reported
Susecontainerdrpmlinux enterprise micro 5.01.4.12-63.1Not reportedSUSE-SU-2022:0720-1Not reported
Susecontainerdrpmlinux enterprise micro 5.11.4.12-63.1Not reportedSUSE-SU-2022:0720-1Not reported
Susetrivyrpmpackage hub 15 sp40.28.0-bp154.2.3.1Not reportedOPENSUSE-SU-2022:10022-1Not reported
Opensusetrivyrpmleap 15.40.28.0-bp154.2.3.1Not reportedOPENSUSE-SU-2022:10022-1Not reported
Opensusecontainerdrpmleap 15.31.4.12-63.1Not reportedOPENSUSE-SU-2022:0720-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [containerd]Unknown
    Details (4)

    • 1.6.20~ds1-1+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 1.6.1~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 1.6.1~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.6.1~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.6.1~ds1-1

      dsa · containerd · debian · bookworm

  • [golang-github-containerd-containerd-dev]Unknown

    Source package: [containerd]

    Details (4)

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.6.1~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.6.1~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.6.1~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.6.1~ds1-1

      dsa · containerd · debian · bookworm

[openSUSE Tumbleweed]

  • [containerd]Unknown

    Source package: [containerd]

    Details (1)

    • 1.7.33-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 1.4.13-1.1

      dsa · containerd · opensuse · tumbleweed

  • [containerd-ctr]Unknown

    Source package: [containerd]

    Details (1)

    • 1.7.33-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.13-1.1

      Version impact unknown

      dsa · containerd · opensuse · tumbleweed

  • [containerd-devel]Unknown

    Source package: [containerd]

    Details (1)

    • 1.7.33-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.4.13-1.1

      Version impact unknown

      dsa · containerd · opensuse · tumbleweed

  • [trivy]Unknown

    Source package: [trivy]

    Details (1)

    • 0.74.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 0.26.0-1.1

      dsa · trivy · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]