Creation of a very deep, nested directory structures inside a container leads to high inode usage, exhausting available system memory and triggering OOM killer. A malicious process inside a container can exploit this to cause a denial of service on the host system.
Additionally, CRI-O will fail to cleanup the malicious container as it's unable to remove the created deep directory. Both Go's stdlib and coreutils `rm` traverse the created directory structure during removal, increasing inode usage and causing system memory to spike, subsequently triggering OOM killer again.
Do we know exactly which filesystem(s) are affected? Or is this a VFS issue that will affect all of them?
Upstream issues (for container removal): https://github.com/golang/go/issues/47390 https://github.com/cri-o/cri-o/issues/5126 Upstream PR (for inode quotas): https://github.com/containers/storage/pull/970