CVE-2022-24778 imgcrypt about image

[rhatdan]

If the suspect code is not vendored into containers/image then containers/image and the tools that base off of it are not vulnerable.

[kaovilai]

Can be resolved by updating containerd to 1.6.1+

[mtrmac]

Thanks for your report. AFAICS nothing in this repo depends on containerd/imgcrypt.

[kaovilai]

@mtrmac github.com/containerd/[email protected] is required by github.com/containerd/[email protected] which is required by github.com/Microsoft/[email protected]
which is specified in

image/go.mod

Line 44 in b694889

github.com/Microsoft/hcsshim v0.9.3 // indirect

github.com/containerd/cgroups v1.0.3

❯ git checkout upstream/main
Note: switching to 'upstream/main'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at b6948897 Merge pull request #1652 from containers/dependabot/go_modules/github.com/docker/docker-20.10.18incompatible

~/git/image remotes/upstream/main
❯ go mod graph | grep imgcrypt
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/Microsoft/[email protected]
github.com/containerd/[email protected] github.com/Microsoft/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containers/[email protected]
github.com/containerd/[email protected] github.com/gogo/[email protected]
github.com/containerd/[email protected] github.com/opencontainers/[email protected]
github.com/containerd/[email protected] github.com/opencontainers/[email protected]
github.com/containerd/[email protected] github.com/opencontainers/[email protected]
github.com/containerd/[email protected] github.com/pkg/[email protected]
github.com/containerd/[email protected] github.com/sirupsen/[email protected]
github.com/containerd/[email protected] github.com/urfave/[email protected]
github.com/containerd/[email protected] golang.org/x/[email protected]
github.com/containerd/[email protected] google.golang.org/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/Microsoft/[email protected]
github.com/containerd/[email protected] github.com/Microsoft/[email protected]
github.com/containerd/[email protected] github.com/Microsoft/hcsshim/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containers/[email protected]
github.com/containerd/[email protected] github.com/gogo/[email protected]
github.com/containerd/[email protected] github.com/imdario/[email protected]
github.com/containerd/[email protected] github.com/opencontainers/[email protected]
github.com/containerd/[email protected] github.com/opencontainers/[email protected]
github.com/containerd/[email protected] github.com/opencontainers/[email protected]
github.com/containerd/[email protected] github.com/pkg/[email protected]
github.com/containerd/[email protected] github.com/prometheus/[email protected]
github.com/containerd/[email protected] github.com/sirupsen/[email protected]
github.com/containerd/[email protected] github.com/urfave/[email protected]
github.com/containerd/[email protected] golang.org/x/[email protected]
github.com/containerd/[email protected] google.golang.org/[email protected]
github.com/containerd/[email protected] gopkg.in/[email protected]
github.com/containerd/[email protected] gotest.tools/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/Microsoft/[email protected]
github.com/containerd/[email protected] github.com/Microsoft/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containers/[email protected]
github.com/containerd/[email protected] github.com/gogo/[email protected]
github.com/containerd/[email protected] github.com/opencontainers/[email protected]
github.com/containerd/[email protected] github.com/opencontainers/[email protected]
github.com/containerd/[email protected] github.com/opencontainers/[email protected]
github.com/containerd/[email protected] github.com/pkg/[email protected]
github.com/containerd/[email protected] github.com/sirupsen/[email protected]
github.com/containerd/[email protected] github.com/urfave/[email protected]
github.com/containerd/[email protected] golang.org/x/[email protected]
github.com/containerd/[email protected] google.golang.org/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/Microsoft/[email protected]
github.com/containerd/[email protected] github.com/Microsoft/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containerd/[email protected]
github.com/containerd/[email protected] github.com/containers/[email protected]
github.com/containerd/[email protected] github.com/coreos/[email protected]
github.com/containerd/[email protected] github.com/docker/[email protected]+incompatible
github.com/containerd/[email protected] github.com/docker/[email protected]
github.com/containerd/[email protected] github.com/docker/[email protected]
github.com/containerd/[email protected] github.com/godbus/[email protected]
github.com/containerd/[email protected] github.com/gogo/[email protected]
github.com/containerd/[email protected] github.com/gogo/[email protected]
github.com/containerd/[email protected] github.com/imdario/[email protected]
github.com/containerd/[email protected] github.com/opencontainers/[email protected]
github.com/containerd/[email protected] github.com/opencontainers/[email protected]
github.com/containerd/[email protected] github.com/opencontainers/[email protected]
github.com/containerd/[email protected] github.com/opencontainers/[email protected]
github.com/containerd/[email protected] github.com/pkg/[email protected]
github.com/containerd/[email protected] github.com/prometheus/[email protected]
github.com/containerd/[email protected] github.com/sirupsen/[email protected]
github.com/containerd/[email protected] github.com/syndtr/[email protected]
github.com/containerd/[email protected] github.com/urfave/[email protected]
github.com/containerd/[email protected] go.etcd.io/[email protected]
github.com/containerd/[email protected] golang.org/x/[email protected]
github.com/containerd/[email protected] golang.org/x/[email protected]
github.com/containerd/[email protected] golang.org/x/[email protected]
github.com/containerd/[email protected] google.golang.org/[email protected]

[kaovilai]

Looks like this won't be easy to solve. Latest containerd have circular dependency with older containerd which depended on imgcrypt <1.1.4

containerd/containerd#5781

[mtrmac]

❯ go mod graph | grep imgcrypt

But then

$ go mod vendor
$ ./vendor/github.com/containerd
./vendor/github.com/containerd/cgroups
./vendor/github.com/containerd/cgroups/stats
./vendor/github.com/containerd/cgroups/stats/v1
./vendor/github.com/containerd/stargz-snapshotter
./vendor/github.com/containerd/stargz-snapshotter/estargz
./vendor/github.com/containerd/stargz-snapshotter/estargz/errorutil

That package just isn’t used. There is nothing to fix.

If we added an explicit imgcrypt dependency to c/image just to force a higher version, the go tooling would immediately drop that dependency as unused.

Whatever vulnerability scanner tool, or methodology, you are using, it’s incorrect and it needs to be fixed not to report packages that don’t show up in the binary at all.

[kaovilai]

Containerd uses imgcrypt so by proxy containers/image/ requires imgcrypt. You simply cannot say it is not in your package when it is clearly in go.sum

image/go.sum

Lines 320 to 323 in 11c01b9

	github.com/containerd/imgcrypt v1.0.1/go.mod h1:mdd8cEPW7TPgNG4FpuP3sGBiQ7Yi/zak9TYCG3juvb0=
	github.com/containerd/imgcrypt v1.0.4-0.20210301171431-0ae5c75f59ba/go.mod h1:6TNsg0ctmizkrOgXRNQjAPFWpMYRWuiB6dSF4Pfa5SA=
	github.com/containerd/imgcrypt v1.1.1-0.20210312161619-7ed62a527887/go.mod h1:5AZJNI6sLHJljKuI9IHnw1pWqo/F0nGDOuR9zgTs7ow=
	github.com/containerd/imgcrypt v1.1.1/go.mod h1:xpLnwiQmEUJPvQoAapeb2SNCxz7Xr6PJrXQb0Dpc4ms=

[kaovilai]

Besides vendor not containing imgcrypt.. containerd does not use CheckAuthorization() function affected by CVE.