=====================================================================

                                CERT-Renater

                     Note d'Information No. 2023/VULN084

_____________________________________________________________________

DATE                : 17/02/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running containerd versions prior to 
                             1.5.18, 1.6.18.

=====================================================================
https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p
_____________________________________________________________________

Supplementary groups are not set up properly
Moderate
dmcgowan published GHSA-hmfx-3pcx-653p
Package
github.com/containerd/containerd (G)

Affected versions
<= 1.5.17, 1.6.0-1.6.17

Patched versions
1.5.18, 1.6.18


Description

Impact

A bug was found in containerd where supplementary groups are not set up 
properly inside a container. If an attacker has direct access to a 
container and manipulates their supplementary group access, they may *be 
able to use supplementary group access to bypass primary group 
restrictions in some cases, potentially gaining access to sensitive 
information or gaining the ability to execute code in that container.

Downstream applications that use the containerd client library may
be affected as well.


Patches

This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should 
update to these versions and recreate containers to resolve this issue. 
Users who rely on a downstream application that uses containerd's client 
library should check that application for a separate advisory and 
instructions.


Workarounds

Ensure that the "USER $USERNAME" Dockerfile instruction is not used.
Instead, set the container entrypoint to a value similar to ENTRYPOINT 
["su", "-", "user"] to allow su to properly set up supplementary groups.


References

 
https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
     Docker/Moby: CVE-2022-36109, fixed in Docker 20.10.18
     CRI-O: CVE-2022-2995, fixed in CRI-O 1.25.0
     Podman: CVE-2022-2989, fixed in Podman 3.0.1 and 4.2.0
     Buildah: CVE-2022-2990, fixed in Buildah 1.27.1

Note that CVE IDs apply to a particular implementation, even if an issue 
is common.


For more information

If you have any questions or comments about this advisory:

     Open an issue in containerd
     Email us at security@containerd.io

To report a security issue in containerd:

     Report a new vulnerability
     Email us at security@containerd.io

Severity
Moderate

CVE ID
CVE-2023-25173

Weaknesses
No CWEs

_____________________________________________________________________

OCI image importer memory exhaustion
Moderate
dmcgowan published GHSA-259w-8hf6-59c2
No package listed

Affected versions
<= 1.5.17, 1.6.0-1.6.17

Patched versions
1.5.18, 1.6.18


Description

Impact

When importing an OCI image, there was no limit on the number of bytes 
read for certain files. A maliciously crafted image with a large file 
where a limit was not applied could cause a denial of service.


Patches

This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should 
update to these versions to resolve the issue.


Workarounds

Ensure that only trusted images are used and that only trusted users 
have permissions to import images.


Credits

The containerd project would like to thank David Korczynski and Adam 
Korczynski of ADA Logics for responsibly disclosing this issue in 
accordance with the containerd security policy during a security fuzzing 
audit sponsored by CNCF.


For more information

If you have any questions or comments about this advisory:

     Open an issue in containerd
     Email us at security@containerd.io

To report a security issue in containerd:

     Report a new vulnerability
     Email us at security@containerd.io

Severity
Moderate

CVE ID
CVE-2023-25153

Weaknesses
CWE-400


Credits

     @AdamKorcz AdamKorcz
     @DavidKorczynski DavidKorczynski

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================