GHSA-rgh6-rfwx-v388 Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

• Go github.com/containerd/containerd/v2: >= 2.1.0, < 2.1.9 → fixed in 2.1.9 • Go github.com/containerd/containerd/v2: >= 2.2.0, < 2.2.5 → fixed in 2.2.5 • Go github.com/containerd/containerd/v2: >= 2.3.0, < 2.3.2 → fixed in 2.3.2

Impact A bug was found in containerd where the CRI plugin restores `container.log` from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via `kubectl logs`. Patches This bug has been fixed in the following containerd versions: • 2.3.2 • 2.2.5 • 2.1.9 Users should update to these versions to resolve the issue. Workarounds Ensure that only trusted images and checkpoints are used. Credits The containerd project would like to thank @gouldnicholas and @davidrxchester, Yuming Zhang and Song Li of Zhejiang University, Sangwon Ryu (@sangwon090), Henry Beberman (@hbeberman) of Microsoft, the GKE Security Team using Gemini, Anthropic Research, in collaboration with Claude, Robert Prast (@robertprast), Kyle Elliott (@kyle-elliott-tob) of Trail of Bits, and Zhenchen Wang (@Plucky923), who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy. For more information If you have any questions or comments about this advisory: • Open an issue in containerd • Email us at [email protected] To report a security issue in containerd: • Report a new vulnerability • Email us at [email protected]