PT-2022-6457 · Docker+11 · Moby+11

Steven J. Murdoch · Published 2022-09-14 · Updated 2025-11-28 · CVE-2023-25173

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions containerd versions prior to 1.6.18 and 1.5.18 Moby (Docker Engine) versions prior to 20.10.18 CRI-O (affected versions not specified) Buildah (affected versions not specified) Podman (affected versions not specified)

Description A bug was found in containerd, Moby (Docker Engine), CRI-O, Buildah, and Podman where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.

Recommendations For containerd versions prior to 1.6.18 and 1.5.18: Update to versions 1.6.18 and 1.5.18 and recreate containers to resolve this issue. For Moby (Docker Engine) versions prior to 20.10.18: Update to version 20.10.18 when it is available and stop and restart running containers for the permissions to be fixed. For CRI-O, Buildah, and Podman: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround for all affected versions, ensure that the "USER $USERNAME" Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to ENTRYPOINT ["su", "-", "user"] to allow su to properly set up supplementary groups.

Exploit

Improper Privilege Management

Incorrect Permission

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-269

CWE-732

CWE-284

CWE-863

CWE-842

Related Identifiers

ALSA-2023:6473

ALSA-2023:6474

ALSA-2023:6939

ALT-PU-2023-1480

ALT-PU-2023-5428

ALT-PU-2024-11153

ALT-PU-2024-12206

AZL-13673

BDU:2023-01488

CESA-2023_6939

CVE-2023-25173

GHSA-4WJJ-JWC9-2X96

GHSA-FJM8-M7M6-2FJP

GHSA-HMFX-3PCX-653P

GHSA-PHJR-8J92-W5V7

GHSA-RC4R-WH2Q-Q6C4

GO-2022-1008

GO-2023-1574

MGASA-2023-0245

OESA-2023-1147

OPENSUSE-SU-2024:12822-1

OPENSUSE-SU-2024:13295-1

OPENSUSE-SU-2025:15779-1

RHSA-2023:3450

RHSA-2023:6473

RHSA-2023:6474

RHSA-2023:6939

RHSA-2023_6473

RHSA-2023_6474

RHSA-2023_6939

SUSE-SU-2023:1826-1

SUSE-SU-2023:1827-1

SUSE-SU-2023:4124-1

USN-6202-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Kubernetes Containerd

Linuxmint

Moby

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 168

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25173.json · Exploit
• 🔥 https://benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation · Exploit
• https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p · Vendor Advisory
• https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a · Patch
• https://bdu.fstec.ru/vul/2023-01488 · Security Note
• https://errata.rockylinux.org/RLSA-2023:6939 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-25173 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1574 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12822-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25173 · Security Note
• https://advisories.mageia.org/MGASA-2023-0245.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4wjj-jwc9-2x96 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-phjr-8j92-w5v7 · Vendor Advisory