Vulnerability-Lookup

USN-5776-1 (UBUNTU-CVE-2022-23471)

Vulnerability from osv_ubuntu – Published: 2022-12-13 08:35 – Updated: 2026-04-27 14:11 – Source website

Summary

containerd vulnerabilities

Details

It was discovered that containerd incorrectly handled memory when receiving certain faulty Exec or ExecSync commands. A remote attacker could possibly use this issue to cause a denial of service or crash containerd. (CVE-2022-23471, CVE-2022-31030)

It was discovered that containerd incorrectly set up inheritable file capabilities. An attacker could possibly use this issue to escalate privileges inside a container. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24769)

It was discovered that containerd incorrectly handled access to encrypted container images when using imgcrypt library. A remote attacker could possibly use this issue to access encrypted images from other users. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24778)

References

URL

Type

	https://ubuntu.com/security/notices/USN-5776-1	ADVISORY
	https://ubuntu.com/security/CVE-2022-23471	REPORT
	https://ubuntu.com/security/CVE-2022-24769	REPORT
	https://ubuntu.com/security/CVE-2022-24778	REPORT
	https://ubuntu.com/security/CVE-2022-31030	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-23471",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-24769",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-24778",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-31030",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu1~18.04.2"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu1~18.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu1~18.04.2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu1~18.04.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2.5-0ubuntu2",
        "1.2.6-0ubuntu1~18.04.1",
        "1.2.6-0ubuntu1~18.04.2",
        "1.3.3-0ubuntu1~18.04.1",
        "1.3.3-0ubuntu1~18.04.2",
        "1.3.3-0ubuntu1~18.04.3",
        "1.3.3-0ubuntu1~18.04.4",
        "1.4.4-0ubuntu1~18.04.2",
        "1.5.2-0ubuntu1~18.04.1",
        "1.5.2-0ubuntu1~18.04.2",
        "1.5.2-0ubuntu1~18.04.3",
        "1.5.5-0ubuntu3~18.04.1",
        "1.5.5-0ubuntu3~18.04.2",
        "1.5.9-0ubuntu1~18.04.1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-23471",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-24769",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-24778",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-31030",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu1~20.04.6"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu1~20.04.6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu1~20.04.6?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu1~20.04.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.10-0ubuntu1",
        "1.3.2-0ubuntu1",
        "1.3.3-0ubuntu1",
        "1.3.3-0ubuntu2",
        "1.3.3-0ubuntu2.1",
        "1.3.3-0ubuntu2.2",
        "1.3.3-0ubuntu2.3",
        "1.4.4-0ubuntu1~20.04.2",
        "1.5.2-0ubuntu1~20.04.1",
        "1.5.2-0ubuntu1~20.04.2",
        "1.5.2-0ubuntu1~20.04.3",
        "1.5.5-0ubuntu3~20.04.1",
        "1.5.5-0ubuntu3~20.04.2",
        "1.5.9-0ubuntu1~20.04.1",
        "1.5.9-0ubuntu1~20.04.4",
        "1.5.9-0ubuntu1~20.04.5"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-23471",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-24769",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-24778",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-31030",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu3.1"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu3.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.5-0ubuntu3",
        "1.5.9-0ubuntu1",
        "1.5.9-0ubuntu2",
        "1.5.9-0ubuntu3"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that containerd incorrectly handled memory\nwhen receiving certain faulty Exec or ExecSync commands. A remote\nattacker could possibly use this issue to cause a denial of service\nor crash containerd. (CVE-2022-23471, CVE-2022-31030)\n\nIt was discovered that containerd incorrectly set up inheritable file\ncapabilities. An attacker could possibly use this issue to escalate \nprivileges inside a container. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24769)\n\nIt was discovered that containerd incorrectly handled access to encrypted\ncontainer images when using imgcrypt library. A remote attacker could\npossibly use this issue to access encrypted images from other users. \nThis issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2022-24778)\n",
  "id": "USN-5776-1",
  "modified": "2026-04-27T14:11:29Z",
  "published": "2022-12-13T08:35:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5776-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-23471"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-24769"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-24778"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-31030"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "containerd vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2022-23471",
    "UBUNTU-CVE-2022-24769",
    "UBUNTU-CVE-2022-24778",
    "UBUNTU-CVE-2022-31030"
  ]
}

UBUNTU-CVE-2022-23471 (CVE-2022-23471)

Vulnerability from osv_ubuntu – Published: 2022-12-08 00:00 – Updated: 2026-06-25 16:53 – Source website

Details

containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers.

Severity

5.7 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2022-23471	REPORT
	https://github.com/containerd/containerd/security…	REPORT
	https://github.com/containerd/containerd/commit/a…	REPORT
	https://ubuntu.com/security/notices/USN-5776-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2022-23471	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.2.6-0ubuntu1~16.04.6+esm7"
          },
          {
            "binary_name": "golang-github-docker-containerd-dev",
            "binary_version": "1.2.6-0ubuntu1~16.04.6+esm7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.2.6-0ubuntu1~16.04.6+esm7?arch=source\u0026distro=esm-apps-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2.1-0ubuntu4~16.04",
        "0.2.3-0ubuntu1~16.04",
        "0.2.5-0ubuntu1~16.04.1",
        "1.2.6-0ubuntu1~16.04.2",
        "1.2.6-0ubuntu1~16.04.3",
        "1.2.6-0ubuntu1~16.04.4",
        "1.2.6-0ubuntu1~16.04.5",
        "1.2.6-0ubuntu1~16.04.6",
        "1.2.6-0ubuntu1~16.04.6+esm1",
        "1.2.6-0ubuntu1~16.04.6+esm2",
        "1.2.6-0ubuntu1~16.04.6+esm4",
        "1.2.6-0ubuntu1~16.04.6+esm5",
        "1.2.6-0ubuntu1~16.04.6+esm6",
        "1.2.6-0ubuntu1~16.04.6+esm7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu1~18.04.2"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu1~18.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu1~18.04.2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu1~18.04.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2.5-0ubuntu2",
        "1.2.6-0ubuntu1~18.04.1",
        "1.2.6-0ubuntu1~18.04.2",
        "1.3.3-0ubuntu1~18.04.1",
        "1.3.3-0ubuntu1~18.04.2",
        "1.3.3-0ubuntu1~18.04.3",
        "1.3.3-0ubuntu1~18.04.4",
        "1.4.4-0ubuntu1~18.04.2",
        "1.5.2-0ubuntu1~18.04.1",
        "1.5.2-0ubuntu1~18.04.2",
        "1.5.2-0ubuntu1~18.04.3",
        "1.5.5-0ubuntu3~18.04.1",
        "1.5.5-0ubuntu3~18.04.2",
        "1.5.9-0ubuntu1~18.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu1~20.04.6"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu1~20.04.6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu1~20.04.6?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu1~20.04.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.10-0ubuntu1",
        "1.3.2-0ubuntu1",
        "1.3.3-0ubuntu1",
        "1.3.3-0ubuntu2",
        "1.3.3-0ubuntu2.1",
        "1.3.3-0ubuntu2.2",
        "1.3.3-0ubuntu2.3",
        "1.4.4-0ubuntu1~20.04.2",
        "1.5.2-0ubuntu1~20.04.1",
        "1.5.2-0ubuntu1~20.04.2",
        "1.5.2-0ubuntu1~20.04.3",
        "1.5.5-0ubuntu3~20.04.1",
        "1.5.5-0ubuntu3~20.04.2",
        "1.5.9-0ubuntu1~20.04.1",
        "1.5.9-0ubuntu1~20.04.4",
        "1.5.9-0ubuntu1~20.04.5"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu3.1"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu3.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.5-0ubuntu3",
        "1.5.9-0ubuntu1",
        "1.5.9-0ubuntu2",
        "1.5.9-0ubuntu3"
      ]
    }
  ],
  "aliases": [],
  "details": "containerd is an open source container runtime. A bug was found in containerd\u0027s CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user\u0027s process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd\u0027s CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16.  Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers.",
  "id": "UBUNTU-CVE-2022-23471",
  "modified": "2026-06-25T16:53:01Z",
  "published": "2022-12-08T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-23471"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/containerd/containerd/security/advisories/GHSA-2qjp-425j-52j9"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/containerd/containerd/commit/a05d175400b1145e5e6a735a6710579d181e7fb0"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5776-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23471"
    }
  ],
  "related": [
    "USN-5776-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-23471"
  ]
}

UBUNTU-CVE-2022-24769 (CVE-2022-24769)

Vulnerability from osv_ubuntu – Published: 2022-03-24 20:15 – Updated: 2026-06-25 16:53 – Source website

Details

Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like capsh(1) to drop inheritable capabilities prior to the primary process starting.

Severity

5.9 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

5.9 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2022-24769	REPORT
	https://github.com/containerd/containerd/security…	REPORT
	https://github.com/moby/moby/security/advisories/…	REPORT
	https://github.com/moby/moby/releases/tag/v20.10.14	REPORT
	https://ubuntu.com/security/notices/USN-5776-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2022-24769	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.2.6-0ubuntu1~16.04.6+esm7"
          },
          {
            "binary_name": "golang-github-docker-containerd-dev",
            "binary_version": "1.2.6-0ubuntu1~16.04.6+esm7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.2.6-0ubuntu1~16.04.6+esm7?arch=source\u0026distro=esm-apps-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2.1-0ubuntu4~16.04",
        "0.2.3-0ubuntu1~16.04",
        "0.2.5-0ubuntu1~16.04.1",
        "1.2.6-0ubuntu1~16.04.2",
        "1.2.6-0ubuntu1~16.04.3",
        "1.2.6-0ubuntu1~16.04.4",
        "1.2.6-0ubuntu1~16.04.5",
        "1.2.6-0ubuntu1~16.04.6",
        "1.2.6-0ubuntu1~16.04.6+esm1",
        "1.2.6-0ubuntu1~16.04.6+esm2",
        "1.2.6-0ubuntu1~16.04.6+esm4",
        "1.2.6-0ubuntu1~16.04.6+esm5",
        "1.2.6-0ubuntu1~16.04.6+esm6",
        "1.2.6-0ubuntu1~16.04.6+esm7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu1~18.04.2"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu1~18.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu1~18.04.2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu1~18.04.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2.5-0ubuntu2",
        "1.2.6-0ubuntu1~18.04.1",
        "1.2.6-0ubuntu1~18.04.2",
        "1.3.3-0ubuntu1~18.04.1",
        "1.3.3-0ubuntu1~18.04.2",
        "1.3.3-0ubuntu1~18.04.3",
        "1.3.3-0ubuntu1~18.04.4",
        "1.4.4-0ubuntu1~18.04.2",
        "1.5.2-0ubuntu1~18.04.1",
        "1.5.2-0ubuntu1~18.04.2",
        "1.5.2-0ubuntu1~18.04.3",
        "1.5.5-0ubuntu3~18.04.1",
        "1.5.5-0ubuntu3~18.04.2",
        "1.5.9-0ubuntu1~18.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu1~20.04.6"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu1~20.04.6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu1~20.04.6?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu1~20.04.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.10-0ubuntu1",
        "1.3.2-0ubuntu1",
        "1.3.3-0ubuntu1",
        "1.3.3-0ubuntu2",
        "1.3.3-0ubuntu2.1",
        "1.3.3-0ubuntu2.2",
        "1.3.3-0ubuntu2.3",
        "1.4.4-0ubuntu1~20.04.2",
        "1.5.2-0ubuntu1~20.04.1",
        "1.5.2-0ubuntu1~20.04.2",
        "1.5.2-0ubuntu1~20.04.3",
        "1.5.5-0ubuntu3~20.04.1",
        "1.5.5-0ubuntu3~20.04.2",
        "1.5.9-0ubuntu1~20.04.1",
        "1.5.9-0ubuntu1~20.04.4",
        "1.5.9-0ubuntu1~20.04.5"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu3.1"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu3.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.5-0ubuntu3",
        "1.5.9-0ubuntu1",
        "1.5.9-0ubuntu2",
        "1.5.9-0ubuntu3"
      ]
    }
  ],
  "aliases": [],
  "details": "Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container\u0027s bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container\u0027s bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.",
  "id": "UBUNTU-CVE-2022-24769",
  "modified": "2026-06-25T16:53:02Z",
  "published": "2022-03-24T20:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-24769"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/containerd/containerd/security/advisories/GHSA-c9cp-9c75-9v8c"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/moby/moby/security/advisories/GHSA-2mm7-x5h6-5pvq"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/moby/moby/releases/tag/v20.10.14"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5776-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24769"
    }
  ],
  "related": [
    "USN-5776-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-24769"
  ]
}

UBUNTU-CVE-2022-24778 (CVE-2022-24778)

Vulnerability from osv_ubuntu – Published: 2022-03-25 18:15 – Updated: 2026-06-25 16:53 – Source website

Details

The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images. The imgcrypt function CheckAuthorization is supposed to check whether the current used is authorized to access an encrypted image and prevent the user from running an image that another user previously decrypted on the same system. In versions prior to 1.1.4, a failure occurs when an image with a ManifestList is used and the architecture of the local host is not the first one in the ManifestList. Only the first architecture in the list was tested, which may not have its layers available locally since it could not be run on the host architecture. Therefore, the verdict on unavailable layers was that the image could be run anticipating that image run failure would occur later due to the layers not being available. However, this verdict to allow the image to run enabled other architectures in the ManifestList to run an image without providing keys if that image had previously been decrypted. A patch has been applied to imgcrypt 1.1.4. Workarounds may include usage of different namespaces for each remote user.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2022-24778	REPORT
	https://github.com/containerd/imgcrypt/releases/t…	REPORT
	https://github.com/containerd/imgcrypt/security/a…	REPORT
	https://ubuntu.com/security/notices/USN-5776-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2022-24778	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.2.6-0ubuntu1~16.04.6+esm7"
          },
          {
            "binary_name": "golang-github-docker-containerd-dev",
            "binary_version": "1.2.6-0ubuntu1~16.04.6+esm7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.2.6-0ubuntu1~16.04.6+esm7?arch=source\u0026distro=esm-apps-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2.1-0ubuntu4~16.04",
        "0.2.3-0ubuntu1~16.04",
        "0.2.5-0ubuntu1~16.04.1",
        "1.2.6-0ubuntu1~16.04.2",
        "1.2.6-0ubuntu1~16.04.3",
        "1.2.6-0ubuntu1~16.04.4",
        "1.2.6-0ubuntu1~16.04.5",
        "1.2.6-0ubuntu1~16.04.6",
        "1.2.6-0ubuntu1~16.04.6+esm1",
        "1.2.6-0ubuntu1~16.04.6+esm2",
        "1.2.6-0ubuntu1~16.04.6+esm4",
        "1.2.6-0ubuntu1~16.04.6+esm5",
        "1.2.6-0ubuntu1~16.04.6+esm6",
        "1.2.6-0ubuntu1~16.04.6+esm7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu1~18.04.2"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu1~18.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu1~18.04.2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu1~18.04.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2.5-0ubuntu2",
        "1.2.6-0ubuntu1~18.04.1",
        "1.2.6-0ubuntu1~18.04.2",
        "1.3.3-0ubuntu1~18.04.1",
        "1.3.3-0ubuntu1~18.04.2",
        "1.3.3-0ubuntu1~18.04.3",
        "1.3.3-0ubuntu1~18.04.4",
        "1.4.4-0ubuntu1~18.04.2",
        "1.5.2-0ubuntu1~18.04.1",
        "1.5.2-0ubuntu1~18.04.2",
        "1.5.2-0ubuntu1~18.04.3",
        "1.5.5-0ubuntu3~18.04.1",
        "1.5.5-0ubuntu3~18.04.2",
        "1.5.9-0ubuntu1~18.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu1~20.04.6"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu1~20.04.6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu1~20.04.6?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu1~20.04.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.10-0ubuntu1",
        "1.3.2-0ubuntu1",
        "1.3.3-0ubuntu1",
        "1.3.3-0ubuntu2",
        "1.3.3-0ubuntu2.1",
        "1.3.3-0ubuntu2.2",
        "1.3.3-0ubuntu2.3",
        "1.4.4-0ubuntu1~20.04.2",
        "1.5.2-0ubuntu1~20.04.1",
        "1.5.2-0ubuntu1~20.04.2",
        "1.5.2-0ubuntu1~20.04.3",
        "1.5.5-0ubuntu3~20.04.1",
        "1.5.5-0ubuntu3~20.04.2",
        "1.5.9-0ubuntu1~20.04.1",
        "1.5.9-0ubuntu1~20.04.4",
        "1.5.9-0ubuntu1~20.04.5"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu3.1"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu3.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.5-0ubuntu3",
        "1.5.9-0ubuntu1",
        "1.5.9-0ubuntu2",
        "1.5.9-0ubuntu3"
      ]
    }
  ],
  "aliases": [],
  "details": "The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images. The imgcrypt function `CheckAuthorization` is supposed to check whether the current used is authorized to access an encrypted image and prevent the user from running an image that another user previously decrypted on the same system. In versions prior to 1.1.4, a failure occurs when an image with a ManifestList is used and the architecture of the local host is not the first one in the ManifestList. Only the first architecture in the list was tested, which may not have its layers available locally since it could not be run on the host architecture. Therefore, the verdict on unavailable layers was that the image could be run anticipating that image run failure would occur later due to the layers not being available. However, this verdict to allow the image to run enabled other architectures in the ManifestList to run an image without providing keys if that image had previously been decrypted. A patch has been applied to imgcrypt 1.1.4. Workarounds may include usage of different namespaces for each remote user.",
  "id": "UBUNTU-CVE-2022-24778",
  "modified": "2026-06-25T16:53:02Z",
  "published": "2022-03-25T18:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-24778"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/containerd/imgcrypt/releases/tag/v1.1.4"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/containerd/imgcrypt/security/advisories/GHSA-8v99-48m9-c8pm"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5776-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24778"
    }
  ],
  "related": [
    "USN-5776-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-24778"
  ]
}

UBUNTU-CVE-2022-31030 (CVE-2022-31030)

Vulnerability from osv_ubuntu – Published: 2022-06-09 14:15 – Updated: 2025-09-08 16:50 – Source website

Details

containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; ExecSync may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.

Severity

5.5 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5.5 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2022-31030	REPORT
	https://github.com/containerd/containerd/security…	REPORT
	https://github.com/containerd/containerd/commit/c…	REPORT
	http://www.openwall.com/lists/oss-security/2022/06/07/1	REPORT
	https://ubuntu.com/security/notices/USN-5776-1	ADVISORY
	https://ubuntu.com/security/notices/USN-5521-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2022-31030	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.2.6-0ubuntu1~16.04.6+esm2"
          },
          {
            "binary_name": "golang-github-docker-containerd-dev",
            "binary_version": "1.2.6-0ubuntu1~16.04.6+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.2.6-0ubuntu1~16.04.6+esm2?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.6-0ubuntu1~16.04.6+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2.1-0ubuntu4~16.04",
        "0.2.3-0ubuntu1~16.04",
        "0.2.5-0ubuntu1~16.04.1",
        "1.2.6-0ubuntu1~16.04.2",
        "1.2.6-0ubuntu1~16.04.3",
        "1.2.6-0ubuntu1~16.04.4",
        "1.2.6-0ubuntu1~16.04.5",
        "1.2.6-0ubuntu1~16.04.6",
        "1.2.6-0ubuntu1~16.04.6+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu1~18.04.2"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu1~18.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu1~18.04.2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu1~18.04.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2.5-0ubuntu2",
        "1.2.6-0ubuntu1~18.04.1",
        "1.2.6-0ubuntu1~18.04.2",
        "1.3.3-0ubuntu1~18.04.1",
        "1.3.3-0ubuntu1~18.04.2",
        "1.3.3-0ubuntu1~18.04.3",
        "1.3.3-0ubuntu1~18.04.4",
        "1.4.4-0ubuntu1~18.04.2",
        "1.5.2-0ubuntu1~18.04.1",
        "1.5.2-0ubuntu1~18.04.2",
        "1.5.2-0ubuntu1~18.04.3",
        "1.5.5-0ubuntu3~18.04.1",
        "1.5.5-0ubuntu3~18.04.2",
        "1.5.9-0ubuntu1~18.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu1~20.04.6"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu1~20.04.6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu1~20.04.6?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu1~20.04.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.10-0ubuntu1",
        "1.3.2-0ubuntu1",
        "1.3.3-0ubuntu1",
        "1.3.3-0ubuntu2",
        "1.3.3-0ubuntu2.1",
        "1.3.3-0ubuntu2.2",
        "1.3.3-0ubuntu2.3",
        "1.4.4-0ubuntu1~20.04.2",
        "1.5.2-0ubuntu1~20.04.1",
        "1.5.2-0ubuntu1~20.04.2",
        "1.5.2-0ubuntu1~20.04.3",
        "1.5.5-0ubuntu3~20.04.1",
        "1.5.5-0ubuntu3~20.04.2",
        "1.5.9-0ubuntu1~20.04.1",
        "1.5.9-0ubuntu1~20.04.4",
        "1.5.9-0ubuntu1~20.04.5"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "containerd",
            "binary_version": "1.5.9-0ubuntu3.1"
          },
          {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.5.9-0ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "containerd",
        "purl": "pkg:deb/ubuntu/containerd@1.5.9-0ubuntu3.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.9-0ubuntu3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.5-0ubuntu3",
        "1.5.9-0ubuntu1",
        "1.5.9-0ubuntu2",
        "1.5.9-0ubuntu3"
      ]
    }
  ],
  "aliases": [],
  "details": "containerd is an open source container runtime. A bug was found in the containerd\u0027s CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd\u0027s CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.",
  "id": "UBUNTU-CVE-2022-31030",
  "modified": "2025-09-08T16:50:14Z",
  "published": "2022-06-09T14:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-31030"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/containerd/containerd/commit/c1bcabb4541930f643aa36a2b38655e131346382"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2022/06/07/1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5776-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5521-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31030"
    }
  ],
  "related": [
    "USN-5776-1",
    "USN-5521-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-31030"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

USN-5776-1 (UBUNTU-CVE-2022-23471)

UBUNTU-CVE-2022-23471 (CVE-2022-23471)

UBUNTU-CVE-2022-24769 (CVE-2022-24769)

UBUNTU-CVE-2022-24778 (CVE-2022-24778)

UBUNTU-CVE-2022-31030 (CVE-2022-31030)

Tags

Sightings

Nomenclature

Related by attack behaviour