containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed.
Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Active
User action required
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
containerd:containerd
References 2
https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4
https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4
https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992…
https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0