Kyle Elliott

**Name of the Vulnerable Software and Affected Versions** containerd versions prior to 2.3.2 containerd versions prior to 2.2.5 containerd versions prior to 2.1.9 containerd versions prior to 2.0.10 containerd versions prior to 1.7.33 **Description** A maliciously crafted image can cause a Denial of Service (DoS) condition. When a container is created from such an image, memory exhaustion occurs, resulting in an Out Of Memory (OOM) kill of the containerd process. This action makes the container runtime API unavailable and can disrupt clients, including the Docker Engine or Kubernetes control-plane components. **Recommendations** Update to version 2.3.2. Update to version 2.2.5. Update to version 2.1.9. Update to version 2.0.10. Update to version 1.7.33. Ensure that only trusted images are used and that only trusted users have permissions to import images or schedule pods.

**Name of the Vulnerable Software and Affected Versions** containerd versions prior to 2.1.9 containerd versions prior to 2.2.5 containerd versions prior to 2.3.2 **Description** A bug in the CRI plugin allows the restoration of `container.log` from a checkpoint image without validating a symlinked path. This can lead to an arbitrary file read on the host system when using `kubectl logs`. **Recommendations** Update to version 2.1.9. Update to version 2.2.5. Update to version 2.3.2. Ensure that only trusted images and checkpoints are used.