CVE-2022-23648 - CVE House
Back to Database
Status published High CVE-2022-23648

Insecure handling of image volumes in containerd CRI plugin

Vulnerability Description

containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23648

Credits & Attribution

No credits recorded in the NVD database.

References

More from containerd

View All →
CVE-2025-64329
containerd CRI server: Host memory exhaustion through Attach goroutine leak
Medium 6.9
CVE-2025-47291
containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
Medium 4.6
CVE-2025-47290
Containerd vulnerable to host filesystem access during image unpack
High 7.6
CVE-2024-40635
containerd has an integer overflow in User ID handling
Medium 4.6
CVE-2024-25621
containerd affected by a local privilege escalation via wide permissions on CRI directory
High 7.3

Affected Vendor

Affected Software

containerd
Vulnerable Versions:
< 1.4.13, >= 1.5.0, < 1.5.10, >= 1.6.0, < 1.6.1

Timeline

Official Publish: March 3rd, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration