The official CVE record is not published yet
Listed from the vendor advisory. It will be replaced with the CVE.org / NVD record once published.
containerd: daemon crash when processing an image manifest with a malformed digest
Summary
Impact
A bug in containerd's image manifest processing causes an unrecovered panic when a child descriptor contains the io.containerd.manifest.subject annotation and a malformed digest. Pulling or importing such an image through the transfer service (including default CRI PullImage reques...
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| go | github.com/containerd/containerd/v2 |
>= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.7, >= 2.4.0, < 2.4.2 |
2.2.10 |
Original description The description as published by the source.
Impact
A bug in containerd's image manifest processing causes an unrecovered panic when a child descriptor contains the io.containerd.manifest.subject annotation and a malformed digest. Pulling or importing such an image through the transfer service (including default CRI PullImage requests) crashes the containerd daemon. In Kubernetes environments, kubelet retries failed image pulls with backoff, allowing a pod referencing an untrusted image to repeatedly crash containerd and disrupt container operations on the worker node.
Patches
This bug has been fixed in containerd 2.4.2, 2.3.7, and 2.2.10. Users should update to these versions to resolve the issue.
Workarounds
Restrict pod image references to trusted registries (for example, using a Kubernetes ValidatingAdmissionPolicy or admission webhook) and only pull or import images from trusted sources.
Credits
The containerd project would like to thank @melihgurlek, LEI WANG (@ssst0n3) and Haoyuan Zhang (@zj1ng7), and OpenSec Intelligence who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy.
For more information
If you have any questions or comments about this advisory:
- Open an issue in containerd
- Email us at security@containerd.io
To report a security issue in container…
Source: Docker Engine (moby) releases NVD GitHub Advisory
References
- DOCKER-ENGINE v29.9.1
- GITHUB_REPO_ADVISORY containerd/containerd