01 Record

CVE-2023-25173

containerd supplementary groups are not set up properly

MediumPUBLISHEDCNA: GitHub_M

CNA base score5.3 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

View raw JSON

02 Description

containerd supplementary groups are not set up properly

03 Exploitation and scoring

Exploitation

Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.

SSVC decision

ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.54% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 45.2% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2023-02-16 14:09Z3 YR AGO

Last updated

2025-03-10 21:10Z1 YR AGO

Reserved

2023-02-03

Assigning CNA

GitHub_M

Record state

PUBLISHED

Severity

Medium (CVSS 5.3)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses

CWE-863Incorrect AuthorizationClass
CWE-842Placement of User into Incorrect GroupBase

Data version

5.1

Document digest

3d7c75c0eef2261ba089f4577479bd21b050574d350f51c74a6363e0e06c0eb6

05 Affected products

VendorProductVersionsPlatforms

containerdcontainerd< 1.5.18, >= 1.6.0, < 1.6.18—

06 References

github.comhttps://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653px_refsource_CONFIRM
github.comhttps://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4x_refsource_MISC
github.comhttps://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460ax_refsource_MISC
github.comhttps://github.com/advisories/GHSA-4wjj-jwc9-2x96x_refsource_MISC
github.comhttps://github.com/advisories/GHSA-fjm8-m7m6-2fjpx_refsource_MISC
github.comhttps://github.com/advisories/GHSA-phjr-8j92-w5v7x_refsource_MISC
github.comhttps://github.com/containerd/containerd/releases/tag/v1.5.18x_refsource_MISC
github.comhttps://github.com/containerd/containerd/releases/tag/v1.6.18x_refsource_MISC
www.benthamsgaze.orghttps://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/x_refsource_MISC
lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/
lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/

07 Fixed in

AlmaLinux 8

aardvark-dns
Fixed in 2:1.7.0-1.module_el8.9.0+3657+d86e192f
buildah
Fixed in 1:1.31.3-1.module_el8.9.0+3643+9234dc3b
buildah-tests
Fixed in 1:1.31.3-1.module_el8.9.0+3643+9234dc3b
cockpit-podman
Fixed in 75-1.module_el8.9.0+3643+9234dc3b
conmon
Fixed in 3:2.1.8-1.module_el8.9.0+3643+9234dc3b
container-selinux
Fixed in 2:2.221.0-1.module_el8.9.0+3643+9234dc3b
containernetworking-plugins
Fixed in 1:1.3.0-4.module_el8.9.0+3643+9234dc3b
containers-common
Fixed in 2:1-54.module_el8.9.0+3673+0c64b403
crit
Fixed in 3.18-4.module_el8.9.0+3643+9234dc3b
criu
Fixed in 3.18-4.module_el8.9.0+3643+9234dc3b
criu-devel
Fixed in 3.18-4.module_el8.9.0+3643+9234dc3b
criu-libs
Fixed in 3.18-4.module_el8.9.0+3643+9234dc3b
crun
Fixed in 1.8.7-1.module_el8.9.0+3643+9234dc3b
fuse-overlayfs
Fixed in 1.12-1.module_el8.9.0+3643+9234dc3b
libslirp
Fixed in 4.4.0-1.module_el8.8.0+3615+3543c705
libslirp-devel
Fixed in 4.4.0-1.module_el8.8.0+3615+3543c705
netavark
Fixed in 2:1.7.0-1.module_el8.9.0+3643+9234dc3b
oci-seccomp-bpf-hook
Fixed in 1.2.9-1.module_el8.9.0+3643+9234dc3b
podman
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
podman-catatonit
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
podman-docker
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
podman-gvproxy
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
podman-plugins
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
podman-remote
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
podman-tests
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
python3-criu
Fixed in 3.18-4.module_el8.9.0+3643+9234dc3b
python3-podman
Fixed in 4.6.0-1.module_el8.9.0+3643+9234dc3b
runc
Fixed in 1:1.1.9-1.module_el8.9.0+3643+9234dc3b
skopeo
Fixed in 2:1.13.3-1.module_el8.9.0+3643+9234dc3b
skopeo-tests
Fixed in 2:1.13.3-1.module_el8.9.0+3643+9234dc3b
slirp4netns
Fixed in 1.2.1-1.module_el8.9.0+3643+9234dc3b
toolbox
Fixed in 0.0.99.4-5.module_el8.9.0+3643+9234dc3b
toolbox-tests
Fixed in 0.0.99.4-5.module_el8.9.0+3643+9234dc3b
udica
Fixed in 0.2.6-20.module_el8.8.0+3615+3543c705

AlmaLinux 9

buildah
Fixed in 1:1.31.3-1.el9
buildah-tests
Fixed in 1:1.31.3-1.el9
podman
Fixed in 2:4.6.1-5.el9
podman-docker
Fixed in 2:4.6.1-5.el9
podman-gvproxy
Fixed in 2:4.6.1-5.el9
podman-plugins
Fixed in 2:4.6.1-5.el9
podman-remote
Fixed in 2:4.6.1-5.el9
podman-tests
Fixed in 2:4.6.1-5.el9

CloudLinux 8

aardvark-dns
Fixed in 2:1.7.0-1.module_el8.9.0+3657+d86e192f
buildah
Fixed in 1:1.31.3-1.module_el8.9.0+3643+9234dc3b
buildah-tests
Fixed in 1:1.31.3-1.module_el8.9.0+3643+9234dc3b
cockpit-podman
Fixed in 75-1.module_el8.9.0+3643+9234dc3b
conmon
Fixed in 3:2.1.8-1.module_el8.9.0+3643+9234dc3b
container-selinux
Fixed in 2:2.221.0-1.module_el8.9.0+3643+9234dc3b
containernetworking-plugins
Fixed in 1:1.3.0-4.module_el8.9.0+3643+9234dc3b
containers-common
Fixed in 2:1-54.module_el8.9.0+3673+0c64b403
crit
Fixed in 3.18-4.module_el8.9.0+3643+9234dc3b
criu
Fixed in 3.18-4.module_el8.9.0+3643+9234dc3b
criu-devel
Fixed in 3.18-4.module_el8.9.0+3643+9234dc3b
criu-libs
Fixed in 3.18-4.module_el8.9.0+3643+9234dc3b
crun
Fixed in 1.8.7-1.module_el8.9.0+3643+9234dc3b
fuse-overlayfs
Fixed in 1.12-1.module_el8.9.0+3643+9234dc3b
libslirp
Fixed in 4.4.0-1.module_el8.8.0+3615+3543c705
libslirp-devel
Fixed in 4.4.0-1.module_el8.8.0+3615+3543c705
netavark
Fixed in 2:1.7.0-1.module_el8.9.0+3643+9234dc3b
oci-seccomp-bpf-hook
Fixed in 1.2.9-1.module_el8.9.0+3643+9234dc3b
podman
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
podman-catatonit
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
podman-docker
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
podman-gvproxy
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
podman-plugins
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
podman-remote
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
podman-tests
Fixed in 3:4.6.1-4.module_el8.9.0+3643+9234dc3b
python3-criu
Fixed in 3.18-4.module_el8.9.0+3643+9234dc3b
python3-podman
Fixed in 4.6.0-1.module_el8.9.0+3643+9234dc3b
runc
Fixed in 1:1.1.9-1.module_el8.9.0+3643+9234dc3b
skopeo
Fixed in 2:1.13.3-1.module_el8.9.0+3643+9234dc3b
skopeo-tests
Fixed in 2:1.13.3-1.module_el8.9.0+3643+9234dc3b
slirp4netns
Fixed in 1.2.1-1.module_el8.9.0+3643+9234dc3b
toolbox
Fixed in 0.0.99.4-5.module_el8.9.0+3643+9234dc3b
toolbox-tests
Fixed in 0.0.99.4-5.module_el8.9.0+3643+9234dc3b
udica
Fixed in 0.2.6-20.module_el8.8.0+3615+3543c705

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

CloudLinux 9

buildah
Fixed in 1:1.31.3-1.el9
buildah-tests
Fixed in 1:1.31.3-1.el9
podman
Fixed in 2:4.6.1-5.el9
podman-docker
Fixed in 2:4.6.1-5.el9
podman-gvproxy
Fixed in 2:4.6.1-5.el9
podman-plugins
Fixed in 2:4.6.1-5.el9
podman-remote
Fixed in 2:4.6.1-5.el9
podman-tests
Fixed in 2:4.6.1-5.el9

Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.

Debian 12

containerd
Fixed in 1.6.18~ds1-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

containerd
Fixed in 1.6.18~ds1-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

containerd
Fixed in 1.6.18~ds1-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 20.04 LTS

containerd
Fixed in 1.6.12-0ubuntu1~20.04.3

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 22.04 LTS

containerd
Fixed in 1.6.12-0ubuntu1~22.04.3

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 16.04 LTS

containerd
Fixed in 1.2.6-0ubuntu1~16.04.6+esm4
Available with Ubuntu Pro: https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 18.04 LTS

containerd
Fixed in 1.6.12-0ubuntu1~18.04.1+esm1
Available with Ubuntu Pro: https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.