Bug 2092848 (CVE-2022-31030) - CVE-2022-31030 containerd: uncontrolled resource consumption may lead to DoS
Summary: CVE-2022-31030 containerd: uncontrolled resource consumption may lead to DoS
Keywords:
Status: NEW
Alias: CVE-2022-31030
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2096943 2096945
Blocks: 2092850
TreeView+ depends on / blocked
 
Reported: 2022-06-02 11:03 UTC by Marian Rehak
Modified: 2024-03-19 12:59 UTC (History)
13 users (show)

Fixed In Version: containerd 1.5.13, containerd 1.6.6
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2022-06-02 11:03:53 UTC 
A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; ExecSync may be used when running probes or when executing processes via an "exec" facility.

Reference:

https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf
Note You need to log in before you can comment on or make changes to this bug.