PT-2022-16873 · Imgcrypt+2 · Imgcrypt+2
Dimitar Dimitrov
+1
·
Published
2022-03-25
·
Updated
2023-01-25
·
CVE-2022-24778
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
imgcrypt versions prior to 1.1.4
Description
The imgcrypt library provides API extensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images. The imgcrypt function
CheckAuthorization is supposed to check whether the current user is authorized to access an encrypted image and prevent the user from running an image that another user previously decrypted on the same system. In versions prior to 1.1.4, a failure occurs when an image with a ManifestList is used and the architecture of the local host is not the first one in the ManifestList. This verdict to allow the image to run enabled other architectures in the ManifestList to run an image without providing keys if that image had previously been decrypted.Recommendations
For imgcrypt versions prior to 1.1.4, update to version 1.1.4 or later to apply the patch.
As a temporary workaround, consider using different namespaces for each remote user to minimize the risk of exploitation.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Ubuntu
Imgcrypt