CVE-2022-1708
published 2022-06-07CVE-2022-1708: A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.83%
85.0th percentile
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| github.com | cri-o_cri-o | >= 0 < 1.22.5 | 1.22.5 |
| github.com | cri-o_cri-o | >= 1.23.0 < 1.23.3 | 1.23.3 |
| github.com | cri-o_cri-o | >= 1.24.0 < 1.24.1 | 1.24.1 |
| kubernetes | cri-o | < 1.19.7 | 1.19.7 |
| kubernetes | cri-o | — | — |
| kubernetes | cri-o | — | — |
| kubernetes | cri-o | >= 1.20.0 < 1.20.8 | 1.20.8 |
| kubernetes | cri-o | >= 1.21.0 < 1.21.8 | 1.21.8 |
| kubernetes | cri-o | >= 1.22.0 < 1.22.5 | 1.22.5 |
| kubernetes | cri-o | >= 1.23.0 < 1.23.3 | 1.23.3 |
| msrc | cbl2_cri-o_1.21.7-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_cri-o_1.22.3-14_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Node DOS by way of memory exhaustion through ExecSync request in CRI-O in github.com/cri-o/cri-o
osv·2024-08-21
CVE-2022-1708 Node DOS by way of memory exhaustion through ExecSync request in CRI-O in github.com/cri-o/cri-o
Node DOS by way of memory exhaustion through ExecSync request in CRI-O in github.com/cri-o/cri-o
Node DOS by way of memory exhaustion through ExecSync request in CRI-O in github.com/cri-o/cri-o
GHSA
Node DOS by way of memory exhaustion through ExecSync request in CRI-O
ghsa·2022-06-06
CVE-2022-1708 [HIGH] CWE-400 Node DOS by way of memory exhaustion through ExecSync request in CRI-O
Node DOS by way of memory exhaustion through ExecSync request in CRI-O
### Description
An ExecSync request runs a command in a container and returns the output to the Kubelet. It is used for readiness and liveness probes within a pod. The way CRI-O runs ExecSync commands is through conmon. CRI-O asks conmon to start the process, and conmon writes the output to disk. CRI-O then reads the output and returns it to the Kubelet.
If the output of the command is large enough, it is possible to exhaust the memory (or disk usage) of the node. The following deployment is an example yaml file that will output around 8GB of ‘A’ characters, which would be written to disk by conmon and read by CRI-O.
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment100
spec:
selector:
matc
OSV
Node DOS by way of memory exhaustion through ExecSync request in CRI-O
osv·2022-06-06
CVE-2022-1708 [HIGH] Node DOS by way of memory exhaustion through ExecSync request in CRI-O
Node DOS by way of memory exhaustion through ExecSync request in CRI-O
### Description
An ExecSync request runs a command in a container and returns the output to the Kubelet. It is used for readiness and liveness probes within a pod. The way CRI-O runs ExecSync commands is through conmon. CRI-O asks conmon to start the process, and conmon writes the output to disk. CRI-O then reads the output and returns it to the Kubelet.
If the output of the command is large enough, it is possible to exhaust the memory (or disk usage) of the node. The following deployment is an example yaml file that will output around 8GB of ‘A’ characters, which would be written to disk by conmon and read by CRI-O.
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment100
spec:
selector:
matc
Microsoft
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output
vendor_msrc·2022-06-14·CVSS 7.5
CVE-2022-1708 [HIGH] CWE-770 A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose
Red Hat
cri-o: memory exhaustion on the node when access to the kube api
vendor_redhat·2022-06-06·CVSS 7.5
CVE-2022-1708 [HIGH] CWE-770 cri-o: memory exhaustion on the node when access to the kube api
cri-o: memory exhaustion on the node when access to the kube api
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API.
No detection rules found.
No public exploits indexed.
arXiv
Exploiting Kubernetes' Image Pull Implementation to Deny Node Availability
arxiv_fulltext·2025-08-08
Exploiting Kubernetes' Image Pull Implementation to Deny Node Availability
Kubernetes' Image Pull Implementation to Deny Node Availability
Luis Augusto Dias Knob1, Matteo Franzil21, Domenico Siracusa21
10pt
1Center for Cybersecurity, Fondazione Bruno Kessler
\ [email protected]
2Department of Information Engineering and Computer Science, University of Trento
\matteo.franzil, domenico.siracusa\@unitn.it
[1]
[1]black#1
[1]
[1]black#1
[1]
[1]black#1
[1]
[1]black#1
[1]black#1
abac[ABAC]Attribute-Based Access Control
acl[ACL]Access Control List
ahd[AHD]Abnormal Health Detection
ai[AI]Artificial Intelligence
alu[ALU]Arithmetic Logic Unit
ann[ANN]Artificial Neural Network
api[API]Application Programming Interface
aks[AKS]Azure Kubernetes Service
gke[GKE]Google Kubernetes Engine
eks[EKS]Amazon Elastic Kubernetes Service
bmv2[BMv2]Behavioral Model version 2
bnn[BN
Checkpoint
26th February – Threat Intelligence Report
blogs_checkpoint·2024-02-26
CVE-2024-1708 26th February – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 26th February – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 26th February, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The American Prince George’s County Public Schools (PGCPS) has experienced a ransomware attack that compromised the personal data of nearly 100K individuals. The attack exposed individuals’ full names, financial account information, and Social Security Numbers. The Rhysida ransomware gang is reportedly responsible for t
https://bugzilla.redhat.com/show_bug.cgi?id=2085361https://github.com/cri-o/cri-o/commit/f032cf649ecc7e0c46718bd9e7814bfb317cb544https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6jhttps://bugzilla.redhat.com/show_bug.cgi?id=2085361https://github.com/cri-o/cri-o/commit/f032cf649ecc7e0c46718bd9e7814bfb317cb544https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6j
2022-06-07
Published