---
updatedAt: 2026-10-06T14:49:33.000Z
agentTools:
  projectIndex: https://hub.armosec.io/llms.txt
---

# C-0087 - CVE-2022-23648-containerd-fs-escape

## Framework

AllControls, ArmoBest

## Severity

High

## Description of the issue

Containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.4.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. This bug was fixed in containerd versions 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue.

## Related resources

Node

## What does this control test

Checking containerd version to see if it is a vulnerable version (where the container runtime is containerd)

## Remediation

Patch containerd to 1.6.1, 1.5.10, 1.4.12  or above

## Example

```
apiVersion: v1
  kind: Node
  metadata:
    spec:
      podCIDR: 10.0.6.0/24
      podCIDRs:
      - 10.0.6.0/24
  status:
    nodeInfo:
      architecture: amd64
      containerRuntimeVersion: containerd://1.4.11
      kernelVersion: 5.4.170+
      operatingSystem: linux
```