Bug 2092848 (CVE-2022-31030)

Summary: CVE-2022-31030 containerd: uncontrolled resource consumption may lead to DoS
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bdettelb, caswilli, crarobin, dffrench, gzaronik, jburrell, jkoehler, jmadigan, kaycoth, ngough, pamccart, rfreiman, rgodfrey
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: containerd 1.5.13, containerd 1.6.6 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2096943, 2096945    
Bug Blocks: 2092850    

Description Marian Rehak 2022-06-02 11:03:53 UTC 
A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; ExecSync may be used when running probes or when executing processes via an "exec" facility.

Reference:

https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf