containerd up to 1.5.17/1.6.17 OCI Image denial of service

Summaryinfo

A vulnerability was found in containerd up to 1.5.17/1.6.17. It has been declared as problematic. This issue affects some unknown processing of the component OCI Image Handler. Such manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2023-25153. Local access is required to approach this attack. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in containerd up to 1.5.17/1.6.17 (Virtualization Software). It has been rated as problematic. Affected by this issue is some unknown processing of the component OCI Image Handler. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. CVE summarizes:

containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

The weakness was disclosed 02/16/2023 as GHSA-259w-8hf6-59c2. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-25153 since 02/03/2023. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.5.18 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 0c314901076a74a7b797a545d2f462285fdbb8c4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Virtualization Software

Name

• containerd

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.4
• 1.5.5
• 1.5.6
• 1.5.7
• 1.5.8
• 1.5.9
• 1.5.10
• 1.5.11
• 1.5.12
• 1.5.13
• 1.5.14
• 1.5.15
• 1.5.16
• 1.5.17
• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11
• 1.6.12
• 1.6.13
• 1.6.14
• 1.6.15
• 1.6.16
• 1.6.17

License

• open-source

Website

• Product: https://github.com/containerd/containerd/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion