The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images. The imgcrypt function `CheckAuthorization` is supposed to check whether the current used is authorized to access an encrypted image and prevent the user from running an image that another user previously decrypted on the same system. In versions prior to 1.1.4, a failure occurs when an image with a ManifestList is used and the architecture of the local host is not the first one in the ManifestList. Only the first architecture in the list was tested, which may not have its layers available locally since it could not be run on the host architecture. Therefore, the verdict on unavailable layers was that the image could be run anticipating that image run failure would occur later due to the layers not being available. However, this verdict to allow the image to run enabled other architectures in the ManifestList to run an image without providing keys if that image had previously been decrypted. A patch has been applied to imgcrypt 1.1.4. Workarounds may include usage of different namespaces for each remote user.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The imgcrypt library provides API exensions for containerd to support encrypted container images and     implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images.
    The imgcrypt function `CheckAuthorization` is supposed to check whether the current used is authorized to     access an encrypted image and prevent the user from running an image that another user previously     decrypted on the same system. In versions prior to 1.1.4, a failure occurs when an image with a     ManifestList is used and the architecture of the local host is not the first one in the ManifestList. Only     the first architecture in the list was tested, which may not have its layers available locally since it     could not be run on the host architecture. Therefore, the verdict on unavailable layers was that the image     could be run anticipating that image run failure would occur later due to the layers not being available.
    However, this verdict to allow the image to run enabled other architectures in the ManifestList to run an     image without providing keys if that image had previously been decrypted. A patch has been applied to     imgcrypt 1.1.4. Workarounds may include usage of different namespaces for each remote user.
    (CVE-2022-24778)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The imgcrypt library provides API exensions for containerd to support encrypted container images and
    implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images.
    The imgcrypt function `CheckAuthorization` is supposed to check whether the current used is authorized to
    access an encrypted image and prevent the user from running an image that another user previously
    decrypted on the same system. In versions prior to 1.1.4, a failure occurs when an image with a
    ManifestList is used and the architecture of the local host is not the first one in the ManifestList. Only
    the first architecture in the list was tested, which may not have its layers available locally since it
    could not be run on the host architecture. Therefore, the verdict on unavailable layers was that the image
    could be run anticipating that image run failure would occur later due to the layers not being available.
    However, this verdict to allow the image to run enabled other architectures in the ManifestList to run an
    image without providing keys if that image had previously been decrypted. A patch has been applied to
    imgcrypt 1.1.4. Workarounds may include usage of different namespaces for each remote user.
    (CVE-2022-24778)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-cfe50b5ebb advisory.

    Automatic update for golang-github-containerd-imgcrypt-1.1.4-1.fc37.

    ##### **Changelog**

    ```
    * Sat Apr  2 2022 Maxwell G <gotmax@e.email> 1.1.4-1
    - Update to 1.1.4 (rhbz#2068719). Mitigates CVE-2022-24778 (rhbz#2069368,       rhbz#2069369)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5776-1 advisory.

    It was discovered that containerd incorrectly handled memory when receiving certain faulty Exec or     ExecSync commands. A remote attacker could possibly use this issue to cause a denial of service or crash     containerd. (CVE-2022-23471, CVE-2022-31030)

    It was discovered that containerd incorrectly set up inheritable file capabilities. An attacker could     possibly use this issue to escalate

    privileges inside a container. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu     22.04 LTS. (CVE-2022-24769)

    It was discovered that containerd incorrectly handled access to encrypted container images when using     imgcrypt library. A remote attacker could possibly use this issue to access encrypted images from other     users.

    This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24778)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
253290	Linux Distros Unpatched Vulnerability : CVE-2022-24778	Nessus	Misc.	Local	high
412859	SCA: security update for github.com/containerd/imgcrypt (GHSA-8v99-48m9-c8pm)	Tenable Cloud Security	SCA Checks	Local	high
412859	SCA: security update for github.com/containerd/imgcrypt (GHSA-8v99-48m9-c8pm)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
211342	Fedora 37 : golang-github-containerd-imgcrypt (2022-cfe50b5ebb)	Nessus	Fedora Local Security Checks	Local	high
168653	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : containerd vulnerabilities (USN-5776-1)	Nessus	Ubuntu Local Security Checks	Local	high

Detections

Analytics

CVE-2022-24778

high

Tenable Plugins

high

high

high

high

high