CVE-2023-25153: containerd OCI image importer memory exhaustion
First published: Thu Feb 16 2023(Updated: )
### Impact When importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. ### Patches This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. ### Workarounds Ensure that only trusted images are used and that only trusted users have permissions to import images. ### Credits The containerd project would like to thank [David Korczynski](https://github.com/DavidKorczynski) and [Adam Korczynski](https://github.com/AdamKorcz) of ADA Logics for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md) during a security fuzzing audit sponsored by CNCF. ### For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose) * Email us at [security@containerd.io](mailto:security@containerd.io) To report a security issue in containerd: * [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new) * Email us at [security@containerd.io](mailto:security@containerd.io)
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linuxfoundation Containerd | <1.5.18 | |
| Linuxfoundation Containerd | >=1.6.0<1.6.18 | |
| redhat/containerd | <1.5.18 | 1.5.18 |
| redhat/contained | <1.6.18 | 1.6.18 |
| go/github.com/containerd/containerd | <1.5.18 | 1.5.18 |
| go/github.com/containerd/containerd | >=1.6.0<1.6.18 | 1.6.18 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/containerd/containerd/commit/0c314901076a74a7b797a545d2f462285fdbb8c4
- https://github.com/containerd/containerd/releases/tag/v1.5.18
- https://github.com/containerd/containerd/releases/tag/v1.6.18
- https://github.com/containerd/containerd/security/advisories/GHSA-259w-8hf6-59c2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2174478
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2174480
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2174481
- https://access.redhat.com/errata/RHSA-2023:6817
- https://bugzilla.redhat.com/show_bug.cgi?id=2174473
- https://nvd.nist.gov/vuln/detail/CVE-2023-25153
- https://pkg.go.dev/vuln/GO-2023-1573
- https://github.com/advisories/GHSA-259w-8hf6-59c2 (Advisory)
Frequently Asked Questions
What is CVE-2023-25153?
CVE-2023-25153 is a vulnerability in the containerd open source container runtime that allows a specially crafted image with a large file to cause a denial of service (DoS) attack.
What is the severity of CVE-2023-25153?
The severity of CVE-2023-25153 is medium with a CVSS score of 5.5.
How does CVE-2023-25153 affect containerd?
CVE-2023-25153 affects containerd versions 1.5.18 and earlier, as well as versions 1.6.0 to 1.6.17. Later versions are not affected.
How can I fix CVE-2023-25153?
To fix CVE-2023-25153, it is recommended to upgrade containerd to the patched versions 1.5.18 or 1.6.18.
Where can I find more information about CVE-2023-25153?
More information about CVE-2023-25153 can be found in the official containerd GitHub repository and the release notes for versions 1.5.18 and 1.6.18.
- collector/nvd-index
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-25153
- agent/software-canonical-lookup
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-259w-8hf6-59c2
- agent/references
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/weakness
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- agent/tags
- collector/github-advisory
- vendor/linuxfoundation
- canonical/linuxfoundation containerd
- version/linuxfoundation containerd/1.6.0
- package-manager/redhat
- package-manager/go