containerd OCI image importer memory exhaustion
CVE-2023-25153

6.2MEDIUM

Key Information:

Vendor

Containerd

Status
Containerd
Vendor
CVE Published:
16 February 2023

What is CVE-2023-25153?

containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

Affected Version(s)

containerd < 1.5.18 < 1.5.18

containerd >= 1.6.0, < 1.6.18 < 1.6.0, 1.6.18

References

https://github.com/containerd/containerd/security/advisor...
x_refsource_CONFIRM
https://github.com/containerd/containerd/commit/0c3149010...
x_refsource_MISC
https://github.com/containerd/containerd/releases/tag/v1....
x_refsource_MISC

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-25153 : containerd OCI image importer memory exhaustion