The Linux Foundation containerd

Insecure handling of image volumes in containerd CRI plugin

Improper Preservation of Permissions in containerd

containerd-shim API Exposed to Host Network Containers

containerd can be coerced into leaking credentials during image pull

environment variable leak

Archive package allows chmod of file outside of unpack target directory

containerd CRI checkpoint restore CDI annotation smuggling

containerd: CRI checkpoint import allows local image tag poisoning

Containerd: Improper Input Validation

containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak

containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

Containerd vulnerable to host filesystem access during image unpack

containerd affected by a local privilege escalation via wide permissions on CRI directory

containerd user ID handling bypass allows runAsNonRoot evasion

containerd supplementary groups are not set up properly

Insufficiently restricted permissions on plugin directories

containerd has an integer overflow in User ID handling

containerd image-triggered runtime DoS via unbounded group parsing

Containerd: Incorrect Privilege Assignment

containerd CRI server: Host memory exhaustion through Attach goroutine leak

containerd OCI image importer memory exhaustion

containerd CRI plugin: Host memory exhaustion through ExecSync