p PatchFirst

CVE-2023-25153

CVE-2023-25153 · containerd OCI image importer memory exhaustion

This page contains facts from public vulnerability sources. Check the original advisory before updating.

containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

CVSS 6.2 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · containers

Affected products and versions

  • containerd

    Versions
    • < 1.5.18: Affected
    • >= 1.6.0, < 1.6.18: Affected

    No fix published

  • containerd Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.6.18~ds1-1

    Update to 1.6.18~ds1-1

  • containerd Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.6.18~ds1-1

    Update to 1.6.18~ds1-1

  • containerd Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.6.18~ds1-1

    Update to 1.6.18~ds1-1

  • containerd Ubuntu:Pro:16.04:LTS

    Versions
    • 0.2.1-0ubuntu4~16.04
    • 0.2.3-0ubuntu1~16.04
    • 0.2.5-0ubuntu1~16.04.1
    • 1.2.6-0ubuntu1~16.04.2
    • 1.2.6-0ubuntu1~16.04.3
    • 1.2.6-0ubuntu1~16.04.4
    • 1.2.6-0ubuntu1~16.04.5
    • 1.2.6-0ubuntu1~16.04.6
    • 1.2.6-0ubuntu1~16.04.6+esm1
    • 1.2.6-0ubuntu1~16.04.6+esm2
    Affected ranges
    • ECOSYSTEM: < 1.2.6-0ubuntu1~16.04.6+esm4

    Update to 1.2.6-0ubuntu1~16.04.6+esm4

  • containerd Ubuntu:Pro:18.04:LTS

    Versions
    • 0.2.5-0ubuntu2
    • 1.2.6-0ubuntu1~18.04.1
    • 1.2.6-0ubuntu1~18.04.2
    • 1.3.3-0ubuntu1~18.04.1
    • 1.3.3-0ubuntu1~18.04.2
    • 1.3.3-0ubuntu1~18.04.3
    • 1.3.3-0ubuntu1~18.04.4
    • 1.4.4-0ubuntu1~18.04.2
    • 1.5.2-0ubuntu1~18.04.1
    • 1.5.2-0ubuntu1~18.04.2
    • 1.5.2-0ubuntu1~18.04.3
    • 1.5.5-0ubuntu3~18.04.1
    • 1.5.5-0ubuntu3~18.04.2
    • 1.5.9-0ubuntu1~18.04.1
    • 1.5.9-0ubuntu1~18.04.2
    • 1.6.12-0ubuntu1~18.04.1
    Affected ranges
    • ECOSYSTEM: < 1.6.12-0ubuntu1~18.04.1+esm1

    Update to 1.6.12-0ubuntu1~18.04.1+esm1

  • containerd Ubuntu:20.04:LTS

    Versions
    • 1.2.10-0ubuntu1
    • 1.3.2-0ubuntu1
    • 1.3.3-0ubuntu1
    • 1.3.3-0ubuntu2
    • 1.3.3-0ubuntu2.1
    • 1.3.3-0ubuntu2.2
    • 1.3.3-0ubuntu2.3
    • 1.4.4-0ubuntu1~20.04.2
    • 1.5.2-0ubuntu1~20.04.1
    • 1.5.2-0ubuntu1~20.04.2
    • 1.5.2-0ubuntu1~20.04.3
    • 1.5.5-0ubuntu3~20.04.1
    • 1.5.5-0ubuntu3~20.04.2
    • 1.5.9-0ubuntu1~20.04.1
    • 1.5.9-0ubuntu1~20.04.4
    • 1.5.9-0ubuntu1~20.04.5
    • 1.5.9-0ubuntu1~20.04.6
    • 1.6.12-0ubuntu1~20.04.1
    Affected ranges
    • ECOSYSTEM: < 1.6.12-0ubuntu1~20.04.3

    Update to 1.6.12-0ubuntu1~20.04.3

  • containerd Ubuntu:22.04:LTS

    Versions
    • 1.5.5-0ubuntu3
    • 1.5.9-0ubuntu1
    • 1.5.9-0ubuntu2
    • 1.5.9-0ubuntu3
    • 1.5.9-0ubuntu3.1
    • 1.6.12-0ubuntu1~22.04.1
    Affected ranges
    • ECOSYSTEM: < 1.6.12-0ubuntu1~22.04.3

    Update to 1.6.12-0ubuntu1~22.04.3

Original sources

Check your server →