Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 533
Alerts This Week
Warning Icon 1 533

Ubuntu 22.04 LTS: USN-5776-1 Moderate: Containerd DoS Threat

ubuntu
Calendar Grey December 13, 2022
Dist Ubuntu Esm H88
Recent advisories on containerd vulnerabilities highlight critical risks, particularly impacting several Ubuntu versions, and necessitate prompt patching to prevent denial of service attacks
Several security issues were fixed in containerd.

Summary

Several security issues were fixed in containerd.

Software Description:

- containerd: daemon to control runC

Details:

It was discovered that containerd incorrectly handled memory

when receiving certain faulty Exec or ExecSync commands. A remote

attacker could possibly use this issue to cause a denial of service

or crash containerd. (CVE-2022-23471, CVE-2022-31030)

It was discovered that containerd incorrectly set up inheritable file

capabilities. An attacker could possibly use this issue to escalate

privileges inside a container. This issue only affected Ubuntu 18.04 LTS,

Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24769)

It was discovered that containerd incorrectly handled access to encrypted

container images when using imgcrypt library. A remote attacker could

possibly use this issue to access encrypted images from other users.

This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and

Ubuntu 22.04 LTS. (CVE-2022-24778)

Topics%20covered

Topics Covered

security advisory denial of service access control ubuntu containerd

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   containerd                      1.6.4-0ubuntu1.1

Ubuntu 22.04 LTS:
   containerd                      1.5.9-0ubuntu3.1

Ubuntu 20.04 LTS:
   containerd                      1.5.9-0ubuntu1~20.04.6

Ubuntu 18.04 LTS:
   containerd                      1.5.9-0ubuntu1~18.04.2

After a standard system update you need to restart containerd to make
all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-5776-1

  CVE-2022-23471, CVE-2022-24769, CVE-2022-24778, CVE-2022-31030

December 13, 2022

Topics%20covered

Topics Covered

security advisory denial of service access control ubuntu containerd

Package Information

  https://launchpad.net/ubuntu/+source/containerd/1.6.4-0ubuntu1.1
  https://launchpad.net/ubuntu/+source/containerd/1.5.9-0ubuntu3.1
https://launchpad.net/ubuntu/+source/containerd/1.5.9-0ubuntu1~20.04.6
https://launchpad.net/ubuntu/+source/containerd/1.5.9-0ubuntu1~18.04.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.