Containerd 1.7.x < 1.7.33 / 2.0.x < 2.0.10 / 2.1.x < 2.1.9 / 2.2.x < 2.2.5 / 2.3.x < 2.3.2 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(322407);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/02");

  script_cve_id("CVE-2026-47262", "CVE-2026-53488");
  script_xref(name:"IAVA", value:"2026-A-0621");

  script_name(english:"Containerd 1.7.x < 1.7.33 / 2.0.x < 2.0.10 / 2.1.x < 2.1.9 / 2.2.x < 2.2.5 / 2.3.x < 2.3.2 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The container runtime installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Containerd on the remote host is 1.7.x prior to 1.7.33, 2.0.x prior to 2.0.10, 2.1.x prior to 2.1.9,
2.2.x prior to 2.2.5, or 2.3.x prior to 2.3.2. It is, therefore, affected by multiple vulnerabilities:

  - A vulnerability in containerd allows a maliciously crafted image to cause a Denial of Service (DoS) condition.
    When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of
    the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the
    Docker Engine or Kubernetes control-plane components. (CVE-2026-47262)

  - A bug was found in containerd where the CRI plugin propagates labels from an image config (LABEL instruction in
    Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via
    a plugin that consumes container labels for some operations. (CVE-2026-53488)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?82ca0458");
  # https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?54d375b1");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Containerd version 1.7.33, 2.0.10, 2.1.9, 2.2.5, 2.3.2 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-53488");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:linuxfoundation:containerd");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("containerd_installed.nbin");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'linux'}}
  ],
  'checks': [
    {
      'product': {'name': 'containerd', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
          {'min_version': '1.7.0', 'fixed_version': '1.7.33'},
          {'min_version': '2.0.0', 'fixed_version': '2.0.10'},
          {'min_version': '2.1.0', 'fixed_version': '2.1.9'},
          {'min_version': '2.2.0', 'fixed_version': '2.2.5'},
          {'min_version': '2.3.0', 'fixed_version': '2.3.2'}
      ]
    }
  ]
};
var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);