containerd supplementary groups are not set up properly
Priority HIGH 67CWE-863Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 12 fixed, 22 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863 and CWE-269.
Summary
containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `"USER $USERNAME"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT ["su", "-", "user"]` to allow `su` to properly set up supplementary groups.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00542 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial containerd (containerd): 1.5.18, 1.6.18github.com/containerd/containerd (Go): 1.5.18, 1.6.18Red Hat: 16 advisoriesRed Hat: 12 fixed, 22 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | containerd | before 1.5.18; 1.6.0 to before 1.6.18 | 1.5.18, 1.6.18 | Patch available | CNA |
| — | github.com/containerd/containerd (Go) | before 1.5.18 | 1.5.18 | Patch available | GHSA-hmfx-3pcx-653p |
| — | github.com/containerd/containerd (Go) | 1.6.0 to before 1.6.18 | 1.6.18 | Patch available | GHSA-hmfx-3pcx-653p |
- containerd Vendorbackstage Affected before 1.5.18; 1.6.0 to before 1.6.18 Fixed in 1.5.18, 1.6.18 Patch available CNA
- github.com/containerd/containerd (Go) Vendor— Affected before 1.5.18 Fixed in 1.5.18 Patch available GHSA-hmfx-3pcx-653p
- github.com/containerd/containerd (Go) Vendor— Affected 1.6.0 to before 1.6.18 Fixed in 1.6.18 Patch available GHSA-hmfx-3pcx-653p
Remediation
- Fix · CNA containerd (containerd) Fixed in 1.5.18, 1.6.18
- Fix · GHSA-hmfx-3pcx-653p github.com/containerd/containerd (Go) Fixed in 1.5.18 Advisory →
- Fix · GHSA-hmfx-3pcx-653p github.com/containerd/containerd (Go) Fixed in 1.6.18 Advisory →
Red Hat 16 advisories
- RHSA-2023:6939 Released 2023-11-14 · Red Hat rating Moderatecontainer-tools:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.aarch64::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.ppc64le::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.s390x::container-tools:rhel8 +47
- RHSA-2023:6817 Released 2023-11-08 · Red Hat rating ImportantOpenShift Virtualization 4.14.0 Images security and bug fix update
- CNV 4.14 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +37
- RHSA-2023:6474 Released 2023-11-07 · Red Hat rating Moderatepodman security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.6.1-5.el9, podman-docker-2:4.6.1-5.el9, podman-gvproxy-2:4.6.1-5.el9 +3
Show 13 more Red Hat advisories
- RHSA-2023:6473 Released 2023-11-07 · Red Hat rating Moderatebuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.31.3-1.el9, buildah-tests-1:1.31.3-1.el9
- RHSA-2023:5006 Released 2023-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.14.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
- RHSA-2023:5314 Released 2023-09-20 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.1.6 security and bug fix update
- 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-velero-plugin-for-aws-rhel8, oadp/oadp-velero-plugin-for-csi-rhel8 +5
- RHSA-2023:4671 Released 2023-08-23 · Red Hat rating ModerateOpenShift Container Platform 4.12.30 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-docker-builder
- RHSA-2023:4488 Released 2023-08-07 · Red Hat rating ModerateRed Hat OpenShift support for Windows Containers 6.0.1[security update]
- Red Hat OpenShift Container Platform 4.11 openshift4-wincw/windows-machine-config-rhel8-operator
- RHSA-2023:4226 Released 2023-07-27 · Red Hat rating ModerateOpenShift Container Platform 4.13.6 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/ose-aws-ebs-csi-driver-rhel8, openshift4/ose-azure-disk-csi-driver-rhel8, openshift4/ose-azure-file-csi-driver-rhel8 +2
- RHSA-2023:4025 Released 2023-07-18 · Red Hat rating LowRed Hat OpenShift support for Windows Containers 7.1.0 [security update]
- Red Hat OpenShift Container Platform 4.12 openshift4-wincw/windows-machine-config-rhel8-operator
- RHSA-2023:3537 Released 2023-06-13 · Red Hat rating ModerateOpenShift Container Platform 4.13.3 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/ose-aws-pod-identity-webhook-rhel8, openshift4/ose-azure-cloud-node-manager-rhel8, openshift4/ose-cloud-credential-operator +7
- RHSA-2023:3455 Released 2023-06-05 · Red Hat rating ModerateRelease of OpenShift Serverless 1.29.0
- Red Hat OpenShift Serverless 1.29 openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8, openshift-serverless-1/client-kn-rhel8 +34
- RHSA-2023:3450 Released 2023-06-05 · Red Hat rating ModerateOpenShift Serverless Client kn 1.29.0 release
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.8.1-3.el8
- RHSA-2023:1326 Released 2023-05-17 · Red Hat rating ImportantOpenShift Container Platform 4.13.0 security update
- Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2023:1372 Released 2023-05-10 · Red Hat rating ModerateRed Hat OpenShift support for Windows Containers 8.0.0 [security update]
- Red Hat OpenShift Container Platform 4.13 openshift4-wincw/windows-machine-config-rhel9-operator
- RHSA-2023:2107 Released 2023-05-04 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.9 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-velero-plugin-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 2 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 2.1 | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform Assisted Installer 1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| cert-manager Operator for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| 8Base-OADP-1.1 | Fixed | RHSA-2023:5314 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2023:2107 |
| CNV 4.14 for RHEL 9 | Fixed | RHSA-2023:6817 |
| OpenShift Sandboxed Containers 1.5 | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:6939 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:6473, RHSA-2023:6474 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2023:4488 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2023:4025, RHSA-2023:4671 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:1326, RHSA-2023:1372, RHSA-2023:3537, RHSA-2023:4226 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2023:5006 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2023:3450 |
| Red Hat OpenShift Serverless 1.29 | Fixed | RHSA-2023:3455 |
Not affected: 17 products
- 8Base-OADP-1.1
- 8Base-RHMTC-1.7
- CNV 4.14 for RHEL 9
- Logging Subsystem for Red Hat OpenShift
- OpenShift Sandboxed Containers 1.5
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 1.2
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenStack Platform 16.2
- Red Hat Openshift Data Foundation 4
Timeline
- 2026-10-02 Threatist record created from CVE-2023-25173
- 2026-10-03 Alias added: GHSA-hmfx-3pcx-653p
References
Advisory 5
Other 12
- https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4
- https://github.com/containerd/containerd/releases/tag/v1.5.18
- https://github.com/containerd/containerd/releases/tag/v1.6.18
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/
- https://github.com/containerd/containerd
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI
- https://pkg.go.dev/vuln/GO-2023-1574
- https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation
More backstage Containerd vulnerabilities
- TI-2021-19622 Improper Preservation of Permissions in containerd CVSS 3.1CRITICAL 9.1
- TI-2022-07700 Insecure handling of image volumes in containerd CRI plugin CVSS 3.1HIGH 7.5
- TI-2026-38567 Improper input validation in backstage containerd CVSS 4.0CRITICAL 9.4
- TI-2026-38569 containerd CRI checkpoint restore CDI annotation smuggling CVSS 4.0HIGH 8.4
- TI-2025-29820 Containerd vulnerable to host filesystem access during image unpack CVSS 4.0HIGH 7.6
- TI-2026-38568 containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore CVSS 4.0HIGH 8.2
Sources
- CVE-2023-25173 · CVE Program
- CVE-2023-25173 · NVD
- FIRST EPSS
- GHSA-hmfx-3pcx-653p · GitHub Advisory Database · CC BY 4.0
- CVE-2023-25173 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences