CVE-2022-31030
containerd CRI plugin: Host memory exhaustion through ExecSync
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.
containerd es un tiempo de ejecución de contenedores de código abierto. Se ha encontrado un error en la implementación de CRI de containerd en el que los programas dentro de un contenedor pueden causar que el demonio containerd consuma memoria sin límites durante la invocación de la API "ExecSync". Esto puede causar que containerd consuma toda la memoria disponible en el equipo, negando el servicio a otras cargas de trabajo legítimas. Tanto Kubernetes como crictl pueden configurarse para usar la implementación CRI de containerd; "ExecSync" puede usarse cuando son ejecutadas sondas o cuando son ejecutados procesos por medio de una instalación "exec". Este error ha sido corregido en containerd versiones 1.6.6 y 1.5.13. Los usuarios deben actualizar a estas versiones para resolver el problema. Los usuarios que no puedan actualizar deberían asegurarse de que sólo son usadas imágenes y comandos confiables
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-05-18 CVE Reserved
- 2022-06-06 CVE Published
- 2023-09-11 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2022/06/07/1 | Mailing List |
|
| https://github.com/containerd/containerd/commit/c1bcabb4541930f643aa36a2b38655e131346382 | Product | |
| https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linuxfoundation Search vendor "Linuxfoundation" | Containerd Search vendor "Linuxfoundation" for product "Containerd" | < 1.5.13 Search vendor "Linuxfoundation" for product "Containerd" and version " < 1.5.13" | - |
Affected
| ||||||
| Linuxfoundation Search vendor "Linuxfoundation" | Containerd Search vendor "Linuxfoundation" for product "Containerd" | >= 1.6.0 < 1.6.6 Search vendor "Linuxfoundation" for product "Containerd" and version " >= 1.6.0 < 1.6.6" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 35 Search vendor "Fedoraproject" for product "Fedora" and version "35" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 36 Search vendor "Fedoraproject" for product "Fedora" and version "36" | - |
Affected
| ||||||