containerd TOCTOU Vulnerability Allows Arbitrary Host File System Modification

A time-of-check to time-of-use (TOCTOU) vulnerability exists in containerd version 2.1.0. During the image unpacking process of an image pull, specially crafted container images have the potential to arbitrarily alter the host file system. This vulnerability is not present in other versions of containerd. The issue has been addressed in containerd version 2.1.1.

Impact

Exploitation of this vulnerability allows for arbitrary modifications to the host file system.

Remediation

Users are advised to update to containerd version 2.1.1. As an additional precaution, only trusted images should be used and only trusted users should be granted permissions to import images.