Source: containerd Version: 2.1.9+ds1-5 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for containerd. CVE-2026-95837[0]: | containerd is an open-source container runtime. From 2.1.0 until | 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore | is vulnerable because CRIU restores process security state from | checkpoint data instead of enforcing the destination | ContainerConfig. An attacker who can create a container from a | crafted checkpoint can supply restored credentials, capabilities, | no_new_privs, and seccomp state. The restored process can run as | root with full capabilities and no enforced seccomp filters while | CRI status reports the requested configuration. Systems that do not | use CRI checkpoint restore are not affected. This issue is fixed in | versions 2.2.7 and 2.3.4. CVE-2026-95838[1]: | containerd is an open-source container runtime. Prior to 1.7.35, | 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler | repeatedly traverses directories for certain opaque whiteout | configurations. A malicious image layer can trigger repeated | directory traversals while opaque whiteouts are processed. Pulling | or importing the image can consume CPU, delay container startup, and | reduce image-pull concurrency for unrelated deployments. This issue | is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-95837 https://www.cve.org/CVERecord?id=CVE-2026-95837 https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f [1] https://security-tracker.debian.org/tracker/CVE-2026-95838 https://www.cve.org/CVERecord?id=CVE-2026-95838 https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
